VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation as a user is able to change the default shared folder location due to a vulnerable symbolic link. Successful exploitation can result in linking to a root owned file.

Advisory ID: VMSA-2022-0012.1

CVSSv3 Range: 7.3

Issue Date: 2022-04-06

Updated On: 2022-04-20

CVE(s): CVE-2022-22962, CVE-2022-22964

Synopsis: VMware Horizon Agent for Linux update addresses multiple vulnerabilities (CVE-2022-22962, CVE-2022-22964)

Share this page on social media

Sign up for Security Advisories

****1\. Impacted Products****

*   VMware Horizon Agent for Linux

****2\. Introduction****

Multiple vulnerabilities in VMware Horizon Agent for Linux were privately reported to VMware. Updates are available to remediate these vulnerabilities in affected VMware products.  

****3a. User-controlled folder path customization privilege escalation vulnerability (CVE-2022-22962)****

VMware Horizon Agent for Linux contains a local privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.3.  

A low-privileged malicious actor with local access to Horizon Agent for Linux may be able to change the default shared folder location due to a vulnerable symbolic link. Successful exploitation can result in linking to a root owned file.  

To remediate CVE-2022-22962 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

VMware would like to thank Jack Luketina for reporting this issue to us.

****3b. User configurable agent privilege escalation vulnerability (CVE-2022-22964)****

VMware Horizon Agent for Linux contains a local privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.3.  

A low-privileged malicious actor with local access to Horizon Agent for Linux may be able to escalate privileges to root due to a vulnerable configuration file.  

To remediate CVE-2022-22964 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.  

VMware would like to thank Jack Luketina for reporting this issue to us.

Product

Version

Running On

CVE Identifier

CVSSv3

Severity

Fixed Version

Workarounds

Additional Documentation

Horizon Agent for Linux

21.x, 20.x, 7.x

Linux

CVE-2022-22962, CVE-2022-22964

7.3

important

2203

None

None

Horizon Agent for RedHat8.x Linux

21.x, 20.x, 7.x

Linux

CVE-2022-22962, CVE-2022-22964

7.3

important

2203

None

None

Horizon Linux Agent Direct-Connection

21.x, 20.x, 7.x

Linux

CVE-2022-22962, CVE-2022-22964

7.3

important

2203

None

None

Horizon Agent

21.x, 20.x, 7.x

Windows

CVE-2022-22962, CVE-2022-22964

N/A

N/A

Unaffected

N/A

N/A

Horizon Agent Direct-Connection

21.x, 20.x, 7.x

Windows

CVE-2022-22962, CVE-2022-22964

N/A

N/A

Unaffected

N/A

N/A

****4\. References****

****5\. Change Log****

**2022-04-06 VMSA-2022-0012**  
Initial security advisory.

2022-04-20 VMSA-2022-0012.1

Corrected impacted components.

****6\. Contact****

CVE-2022-22962: VMSA-2022-0012.1

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

All Vulnerability Reports

**CVE-2022-22950: Spring Expression DoS Vulnerability**  
**Severity**

Medium

**Vendor**

Spring by VMware

**Description**

In Spring Framework versions 5.3.0 - 5.3.16, 5.2.0 - 5.2.19, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

**Affected VMware Products and Versions**

Severity is medium unless otherwise noted.

*   Spring Framework
    *   5.3.0 to 5.3.16
    *   5.2.0 to 5.2.19
    *   Older, unsupported versions are also affected

**Mitigation**

Users of affected versions should apply the following mitigation: 5.3.x users should upgrade to 5.3.17+. 5.2.x users should upgrade to 5.2.20+. No other steps are necessary. Releases that have fixed this issue include:

*   Spring Framework
    *   5.3.17+
    *   5.2.20+

**Credit**

This vulnerability was initially discovered and responsibly reported by 4ra1n.

**References**

*   https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
*   https://cwe.mitre.org/data/definitions/770.html

**History**

2022-03-28: Initial vulnerability report published.  
2022-04-05: Clarification that fix was backported to Spring Framework 5.2.20.

CVE-2022-22950: CVE-2022-22950 | Security

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

All Vulnerability Reports

**CVE-2022-22963: Remote code execution in Spring Cloud Function by malicious Spring Expression**  
**Severity**

Critical

**Vendor**

Spring by VMware

**Description**

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

**Affected VMware Products and Versions**

Severity is critical unless otherwise noted.

*   Spring Cloud Function
    *   3.1.6
    *   3.2.2
    *   Older, unsupported versions are also affected

**Mitigation**

Users of affected versions should upgrade to 3.1.7, 3.2.3. No other steps are necessary. Releases that have fixed this issue include:

*   Spring Cloud Function
    *   3.1.7
    *   3.2.3

**Credit**

This vulnerability was initially discovered and responsibly reported by m09u3r.

**References**

*   https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
*   https://cwe.mitre.org/data/definitions/770.html
*   https://cwe.mitre.org/data/definitions/497.html

**History**

2022-03-29: Initial vulnerability report published.  
2022-03-31: Updates to description, severity and references.

CVE-2022-22963: CVE-2022-22963 | Security

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.

'2069625?cve=title' is not a valid bug number nor an alias to a bug.

Please press **Back** and try again.

CVE-2022-1050: Invalid Bug ID

*   
*   
*   
*   
*   
*   

**Bug 2069625** (CVE-2022-1050) - CVE-2022-1050 QEMU: pvrdma: use-after-free issue in pvrdma\_exec\_cmd()

Summary: CVE-2022-1050 QEMU: pvrdma: use-after-free issue in pvrdma\_exec\_cmd()

Keywords:

Status:

CLOSED NOTABUG

Alias:

CVE-2022-1050

Product:

Security Response

Classification:

Other

Component:

vulnerability

Sub Component:

Version:

unspecified

Hardware:

All

OS:

Linux

Priority:

low

Severity:

low

Target Milestone:

\---

Assignee:

Red Hat Product Security

QA Contact:

Docs Contact:

URL:

Whiteboard:

Depends On:

2069627

Blocks:

2066710 2069629

TreeView+

depends on / blocked

Reported:

2022-03-29 09:45 UTC by Mauro Matteo Cascella

Modified:

2022-04-28 16:05 UTC (History)

CC List:

25 users (show)

Fixed In Version:

qemu 2.20.1

Doc Type:

\---

Doc Text:

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.

Clone Of:

Environment:

Last Closed:

2022-03-29 14:31:14 UTC

  

Attachments

(Terms of Use)

Add an attachment (proposed patch, testcase, etc.)

  

Description Mauro Matteo Cascella 2022-03-29 09:45:38 UTC

Guest driver might execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.

Upstream patch:
https://lists.nongnu.org/archive/html/qemu-devel/2022-04/msg00273.html

Comment 1 Mauro Matteo Cascella 2022-03-29 09:58:04 UTC

Created qemu tracking bugs for this issue:

Affects: fedora-all \[bug 2069627\]

Comment 2 Product Security DevOps Team 2022-03-29 14:31:11 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-1050

Note You need to log in before you can comment on or make changes to this bug.

*   
*   
*   
*   
*   
*

CVE-2022-1050: 2069625 – (CVE-2022-1050) CVE-2022-1050 QEMU: pvrdma: use-after-free issue in pvrdma_exec_cmd()

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" command due to improper memory remapping (mremap). This flaw allows a malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to system availability.

'1966266?cve=title' is not a valid bug number nor an alias to a bug.

Please press **Back** and try again.

CVE-2021-3582: Invalid Bug ID

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   AWS Credentials Plugin
*   Dashboard View Plugin
*   dbCharts Plugin
*   Environment Dashboard Plugin
*   Extended Choice Parameter Plugin
*   Favorite Plugin
*   Folder-based Authorization Strategy Plugin
*   GitLab Authentication Plugin
*   global-build-stats Plugin
*   incapptic connect uploader Plugin
*   kubernetes-cd Plugin
*   List Git Branches Parameter Plugin
*   Parameterized Trigger Plugin
*   Release Helper Plugin
*   Semantic Versioning Plugin
*   Vmware vRealize CodeStream Plugin

**Descriptions****Sensitive parameter values captured in build metadata files by Parameterized Trigger Plugin**

**SECURITY-2185 / CVE-2022-27195**  
**Severity (CVSS):** Low  
**Affected plugin: parameterized-trigger**  
**Description:**

Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Parameterized Trigger Plugin, including password parameter values, in their build.xml files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system.

Parameterized Trigger Plugin 2.43.1 does not store captured environment variables in build.xml files.

Existing build.xml files are not automatically updated to remove captured environment variables. They need to be manually cleaned up. To help with this, the plugin will report environment variables stored in build.xml as unloadable data in the Old Data Monitor, that allows discarding this data. Build records are only loaded from disk when needed however, so some builds stored in Jenkins may not immediately appear there.

**Stored XSS vulnerability in Favorite Plugin**

**SECURITY-2557 / CVE-2022-27196**  
**Severity (CVSS):** High  
**Affected plugin: favorite**  
**Description:**

Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.

Favorite Plugin 2.4.1 escapes the names of jobs in the favorite column.

**Stored XSS vulnerability in Dashboard View Plugin**

**SECURITY-2559 / CVE-2022-27197**  
**Severity (CVSS):** High  
**Affected plugin: dashboard-view**  
**Description:**

Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet’s Iframe source URL.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.

Dashboard View Plugin 2.18.1 performs URL validation for the Iframe Portlet’s Iframe source URL.

Additionally, Dashboard View Plugin 2.18.1 sets the sandbox attribute for the iframe to restrict the included page.

In case of problems, the Java system property hudson.plugins.view.dashboard.core.IframePortlet.sandboxAttributeValue can be used to customize the sandbox attribute value. The Java system property hudson.plugins.view.dashboard.core.IframePortlet.doNotUseSandbox can be used to disable the sandbox completely.

**CSRF vulnerability and missing permission checks in AWS Credentials Plugin**

**SECURITY-2351 / CVE-2022-27198 (CSRF), CVE-2022-27199 (permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: aws-credentials**  
**Description:**

AWS Credentials Plugin 189.v3551d5642995 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

This form validation method requires POST requests and Overall/Administer permission in AWS Credentials Plugin 191.vcb\_f183ce58b\_9.

**Stored XSS vulnerability in Folder-based Authorization Strategy Plugin**

**SECURITY-2646 / CVE-2022-27200**  
**Severity (CVSS):** Medium  
**Affected plugin: folder-auth**  
**Description:**

Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

Folder-based Authorization Strategy Plugin 1.4 escapes the names of roles shown on the configuration form.

**Agent-to-controller security bypass in Semantic Versioning Plugin**

**SECURITY-2124 / CVE-2022-27201**  
**Severity (CVSS):** High  
**Affected plugin: semantic-versioning-plugin**  
**Description:**

Semantic Versioning Plugin defines a controller/agent message that processes a given file as XML and returns version information. The XML parser is not configured to prevent XML external entity (XXE) attacks, which is only a problem if XML documents are parsed on the Jenkins controller.

Semantic Versioning Plugin 1.13 and earlier does not restrict execution of the controller/agent message to agents, and implements no limitations about the file path that can be parsed. This allows attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

Semantic Versioning Plugin 1.14 does not allow the affected controller/agent message to be submitted by agents for execution on the controller.

**Stored XSS vulnerability in Extended Choice Parameter Plugin**

**SECURITY-2232 / CVE-2022-27202**  
**Severity (CVSS):** High  
**Affected plugin: extended-choice-parameter**  
**Description:**

Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier does not escape the value and description of Extended Choice Parameters with parameter type 'Radio Buttons' or 'Check Boxes'.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

**Arbitrary JSON and property file read vulnerability in Extended Choice Parameter Plugin**

**SECURITY-1351 / CVE-2022-27203**  
**Severity (CVSS):** Medium  
**Affected plugin: extended-choice-parameter**  
**Description:**

Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller.

**CSRF vulnerability and missing permission checks in Extended Choice Parameter Plugin allow SSRF**

**SECURITY-1350 / CVE-2022-27204 (CSRF), CVE-2022-27205 (permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: extended-choice-parameter**  
**Description:**

Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier does not perform a permission check on form validation methods. This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Client Secret stored in plain text by GitLab Authentication Plugin**

**SECURITY-1891 / CVE-2022-27206**  
**Severity (CVSS):** Low  
**Affected plugin: gitlab-oauth**  
**Description:**

GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller as part of its configuration.

This client secret can be viewed by users with access to the Jenkins controller file system.

**Stored XSS vulnerability in global-build-stats Plugin**

**SECURITY-1886 / CVE-2022-27207**  
**Severity (CVSS):** Medium  
**Affected plugin: global-build-stats**  
**Description:**

global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

**Arbitrary file read vulnerability in kubernetes-cd Plugin**

**SECURITY-2096 / CVE-2022-27208**  
**Severity (CVSS):** Medium  
**Affected plugin: kubernetes-cd**  
**Description:**

kubernetes-cd Plugin contributes the 'Kubernetes configuration (kubeconfig)' credential type.

kubernetes-cd Plugin 2.3.1 and earlier allows users with Credentials/Create or Credentials/Update permission to read arbitrary files on the Jenkins controller by defining a 'From a file on the Jenkins master' Kubeconfig source for such a credential.

**Missing permission checks in kubernetes-cd Plugin allow enumerating credentials IDs**

**SECURITY-2636 / CVE-2022-27209**  
**Severity (CVSS):** Medium  
**Affected plugin: kubernetes-cd**  
**Description:**

kubernetes-cd Plugin 2.3.1 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

**CSRF vulnerability and missing permission checks in kubernetes-cd Plugin allow capturing credentials**

**SECURITY-2681 / CVE-2022-27210 (CSRF), CVE-2022-27211 (permission check)**  
**Severity (CVSS):** High  
**Affected plugin: kubernetes-cd**  
**Description:**

kubernetes-cd Plugin 2.3.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Stored XSS vulnerability in List Git Branches Parameter Plugin**

**SECURITY-2167 / CVE-2022-27212**  
**Severity (CVSS):** High  
**Affected plugin: list-git-branches-parameter**  
**Description:**

List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name or default value of the 'List Git branches (and more)' parameter. Additionally, List Git Branches Parameter Plugin explicitly disables a protection mechanism introduced in Jenkins 2.44 and LTS 2.32.2 to prevent exploitation of unescaped parameter names.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

**Stored XSS vulnerability in Environment Dashboard Plugin**

**SECURITY-2252 / CVE-2022-27213**  
**Severity (CVSS):** High  
**Affected plugin: environment-dashboard**  
**Description:**

Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.

**CSRF vulnerability and missing permission checks in Release Helper Plugin**

**SECURITY-2274 / CVE-2022-27214 (CSRF), CVE-2022-27215 (permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: release-helper**  
**Description:**

Release Helper Plugin 1.3.3 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Passwords stored in plain text by dbCharts Plugin**

**SECURITY-2159 / CVE-2022-27216**  
**Severity (CVSS):** Low  
**Affected plugin: dbCharts**  
**Description:**

dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file hudson.plugins.dbcharts.DbChartPublisher.xml on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with access to the Jenkins controller file system.

**Passwords stored in plain text by Vmware vRealize CodeStream Plugin**

**SECURITY-2238 / CVE-2022-27217**  
**Severity (CVSS):** Medium  
**Affected plugin: vmware-vrealize-codestream**  
**Description:**

Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

**Personal tokens stored in plain text by incapptic connect uploader Plugin**

**SECURITY-2273 / CVE-2022-27218**  
**Severity (CVSS):** Medium  
**Affected plugin: incapptic-connect-uploader**  
**Description:**

incapptic connect uploader Plugin 1.15 and earlier stores personal tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

**Severity**

*   SECURITY-1350: Medium
*   SECURITY-1351: Medium
*   SECURITY-1886: Medium
*   SECURITY-1891: Low
*   SECURITY-2096: Medium
*   SECURITY-2124: High
*   SECURITY-2159: Low
*   SECURITY-2167: High
*   SECURITY-2185: Low
*   SECURITY-2232: High
*   SECURITY-2238: Medium
*   SECURITY-2252: High
*   SECURITY-2273: Medium
*   SECURITY-2274: Medium
*   SECURITY-2351: Medium
*   SECURITY-2557: High
*   SECURITY-2559: High
*   SECURITY-2636: Medium
*   SECURITY-2646: Medium
*   SECURITY-2681: High

**Affected Versions**

*   **AWS Credentials Plugin** up to and including 189.v3551d5642995
*   **Dashboard View Plugin** up to and including 2.18
*   **dbCharts Plugin** up to and including 0.5.2
*   **Environment Dashboard Plugin** up to and including 1.1.10
*   **Extended Choice Parameter Plugin** up to and including 346.vd87693c5a\_86c
*   **Favorite Plugin** up to and including 2.4.0
*   **Folder-based Authorization Strategy Plugin** up to and including 1.3
*   **GitLab Authentication Plugin** up to and including 1.13
*   **global-build-stats Plugin** up to and including 1.5
*   **incapptic connect uploader Plugin** up to and including 1.15
*   **kubernetes-cd Plugin** up to and including 2.3.1
*   **List Git Branches Parameter Plugin** up to and including 0.0.9
*   **Parameterized Trigger Plugin** up to and including 2.43
*   **Release Helper Plugin** up to and including 1.3.3
*   **Semantic Versioning Plugin** up to and including 1.13
*   **Vmware vRealize CodeStream Plugin** up to and including 1.2

**Fix**

*   **AWS Credentials Plugin** should be updated to version 191.vcb\_f183ce58b\_9
*   **Dashboard View Plugin** should be updated to version 2.18.1
*   **Favorite Plugin** should be updated to version 2.4.1
*   **Folder-based Authorization Strategy Plugin** should be updated to version 1.4
*   **Parameterized Trigger Plugin** should be updated to version 2.43.1
*   **Semantic Versioning Plugin** should be updated to version 1.14

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   dbCharts Plugin
*   Environment Dashboard Plugin
*   Extended Choice Parameter Plugin
*   GitLab Authentication Plugin
*   global-build-stats Plugin
*   incapptic connect uploader Plugin
*   kubernetes-cd Plugin
*   List Git Branches Parameter Plugin
*   Release Helper Plugin
*   Vmware vRealize CodeStream Plugin

Learn why we announce these issues.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-2124, SECURITY-2681
*   **Gunther Rademacher** for SECURITY-2185
*   **Jesse Glick, CloudBees, Inc.** for SECURITY-2096
*   **Justin Philip** for SECURITY-2252
*   **Kevin Guerroudj** for SECURITY-2232, SECURITY-2238
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2636, SECURITY-2646
*   **Kevin Guerroudj, CloudBees, Inc. and Wadeck Follonier, CloudBees, Inc.** for SECURITY-2557
*   **Matt Sicker, CloudBees, Inc. and, independently, Marc Heyries** for SECURITY-1891
*   **Oleg Nenashev, CloudBees, Inc.** for SECURITY-1350, SECURITY-1351
*   **Quentin Parra** for SECURITY-2273, SECURITY-2274
*   **Son Nguyen (@s0nnguy3n\_)** for SECURITY-2159
*   **Son Nguyen (@s0nnguy3n\_), and, independently, Kevin Guerroudj** for SECURITY-2167
*   **Wadeck Follonier, CloudBees, Inc. and Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2559
*   **Wadeck Follonier, CloudBees, Inc., and, independently, Kevin Guerroudj** for SECURITY-1886

CVE-2022-27203: Jenkins Security Advisory 2022-03-15

A missing permission check in Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.

This advisory announces vulnerabilities in the following Jenkins deliverables:

*   CloudBees AWS Credentials Plugin
*   Dashboard View Plugin
*   dbCharts Plugin
*   Environment Dashboard Plugin
*   Extended Choice Parameter Plugin
*   Favorite Plugin
*   Folder-based Authorization Strategy Plugin
*   GitLab Authentication Plugin
*   global-build-stats Plugin
*   incapptic connect uploader Plugin
*   kubernetes-cd Plugin
*   List Git Branches Parameter Plugin
*   Parameterized Trigger Plugin
*   Release Helper Plugin
*   Semantic Versioning Plugin
*   Vmware vRealize CodeStream Plugin

**Descriptions****Sensitive parameter values captured in build metadata files by Parameterized Trigger Plugin**

**SECURITY-2185 / CVE-2022-27195**  
**Severity (CVSS):** Low  
**Affected plugin: parameterized-trigger**  
**Description:**

Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Parameterized Trigger Plugin, including password parameter values, in their build.xml files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system.

Parameterized Trigger Plugin 2.43.1 does not store captured environment variables in build.xml files.

Existing build.xml files are not automatically updated to remove captured environment variables. They need to be manually cleaned up. To help with this, the plugin will report environment variables stored in build.xml as unloadable data in the Old Data Monitor, that allows discarding this data. Build records are only loaded from disk when needed however, so some builds stored in Jenkins may not immediately appear there.

**Stored XSS vulnerability in Favorite Plugin**

**SECURITY-2557 / CVE-2022-27196**  
**Severity (CVSS):** High  
**Affected plugin: favorite**  
**Description:**

Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.

Favorite Plugin 2.4.1 escapes the names of jobs in the favorite column.

**Stored XSS vulnerability in Dashboard View Plugin**

**SECURITY-2559 / CVE-2022-27197**  
**Severity (CVSS):** High  
**Affected plugin: dashboard-view**  
**Description:**

Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet’s Iframe source URL.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.

Dashboard View Plugin 2.18.1 performs URL validation for the Iframe Portlet’s Iframe source URL.

Additionally, Dashboard View Plugin 2.18.1 sets the sandbox attribute for the iframe to restrict the included page.

In case of problems, the Java system property hudson.plugins.view.dashboard.core.IframePortlet.sandboxAttributeValue can be used to customize the sandbox attribute value. The Java system property hudson.plugins.view.dashboard.core.IframePortlet.doNotUseSandbox can be used to disable the sandbox completely.

**CSRF vulnerability and missing permission checks in CloudBees AWS Credentials Plugin**

**SECURITY-2351 / CVE-2022-27198 (CSRF), CVE-2022-27199 (permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: aws-credentials**  
**Description:**

CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

This form validation method requires POST requests and Overall/Administer permission in CloudBees AWS Credentials Plugin 191.vcb\_f183ce58b\_9.

**Stored XSS vulnerability in Folder-based Authorization Strategy Plugin**

**SECURITY-2646 / CVE-2022-27200**  
**Severity (CVSS):** Medium  
**Affected plugin: folder-auth**  
**Description:**

Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

Folder-based Authorization Strategy Plugin 1.4 escapes the names of roles shown on the configuration form.

**Agent-to-controller security bypass in Semantic Versioning Plugin**

**SECURITY-2124 / CVE-2022-27201**  
**Severity (CVSS):** High  
**Affected plugin: semantic-versioning-plugin**  
**Description:**

Semantic Versioning Plugin defines a controller/agent message that processes a given file as XML and returns version information. The XML parser is not configured to prevent XML external entity (XXE) attacks, which is only a problem if XML documents are parsed on the Jenkins controller.

Semantic Versioning Plugin 1.13 and earlier does not restrict execution of the controller/agent message to agents, and implements no limitations about the file path that can be parsed. This allows attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the LTS upgrade guide.

Semantic Versioning Plugin 1.14 does not allow the affected controller/agent message to be submitted by agents for execution on the controller.

**Stored XSS vulnerability in Extended Choice Parameter Plugin**

**SECURITY-2232 / CVE-2022-27202**  
**Severity (CVSS):** High  
**Affected plugin: extended-choice-parameter**  
**Description:**

Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier does not escape the value and description of Extended Choice Parameters with parameter type 'Radio Buttons' or 'Check Boxes'.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

**Arbitrary JSON and property file read vulnerability in Extended Choice Parameter Plugin**

**SECURITY-1351 / CVE-2022-27203**  
**Severity (CVSS):** Medium  
**Affected plugin: extended-choice-parameter**  
**Description:**

Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller.

**CSRF vulnerability and missing permission checks in Extended Choice Parameter Plugin allow SSRF**

**SECURITY-1350 / CVE-2022-27204 (CSRF), CVE-2022-27205 (permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: extended-choice-parameter**  
**Description:**

Extended Choice Parameter Plugin 346.vd87693c5a\_86c and earlier does not perform a permission check on form validation methods. This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Client Secret stored in plain text by GitLab Authentication Plugin**

**SECURITY-1891 / CVE-2022-27206**  
**Severity (CVSS):** Low  
**Affected plugin: gitlab-oauth**  
**Description:**

GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller as part of its configuration.

This client secret can be viewed by users with access to the Jenkins controller file system.

**Stored XSS vulnerability in global-build-stats Plugin**

**SECURITY-1886 / CVE-2022-27207**  
**Severity (CVSS):** Medium  
**Affected plugin: global-build-stats**  
**Description:**

global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

**Arbitrary file read vulnerability in kubernetes-cd Plugin**

**SECURITY-2096 / CVE-2022-27208**  
**Severity (CVSS):** Medium  
**Affected plugin: kubernetes-cd**  
**Description:**

kubernetes-cd Plugin contributes the 'Kubernetes configuration (kubeconfig)' credential type.

kubernetes-cd Plugin 2.3.1 and earlier allows users with Credentials/Create or Credentials/Update permission to read arbitrary files on the Jenkins controller by defining a 'From a file on the Jenkins master' Kubeconfig source for such a credential.

**Missing permission checks in kubernetes-cd Plugin allow enumerating credentials IDs**

**SECURITY-2636 / CVE-2022-27209**  
**Severity (CVSS):** Medium  
**Affected plugin: kubernetes-cd**  
**Description:**

kubernetes-cd Plugin 2.3.1 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

**CSRF vulnerability and missing permission checks in kubernetes-cd Plugin allow capturing credentials**

**SECURITY-2681 / CVE-2022-27210 (CSRF), CVE-2022-27211 (permission check)**  
**Severity (CVSS):** High  
**Affected plugin: kubernetes-cd**  
**Description:**

kubernetes-cd Plugin 2.3.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Stored XSS vulnerability in List Git Branches Parameter Plugin**

**SECURITY-2167 / CVE-2022-27212**  
**Severity (CVSS):** High  
**Affected plugin: list-git-branches-parameter**  
**Description:**

List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name or default value of the 'List Git branches (and more)' parameter. Additionally, List Git Branches Parameter Plugin explicitly disables a protection mechanism introduced in Jenkins 2.44 and LTS 2.32.2 to prevent exploitation of unescaped parameter names.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

**Stored XSS vulnerability in Environment Dashboard Plugin**

**SECURITY-2252 / CVE-2022-27213**  
**Severity (CVSS):** High  
**Affected plugin: environment-dashboard**  
**Description:**

Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.

**CSRF vulnerability and missing permission checks in Release Helper Plugin**

**SECURITY-2274 / CVE-2022-27214 (CSRF), CVE-2022-27215 (permission check)**  
**Severity (CVSS):** Medium  
**Affected plugin: release-helper**  
**Description:**

Release Helper Plugin 1.3.3 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

**Passwords stored in plain text by dbCharts Plugin**

**SECURITY-2159 / CVE-2022-27216**  
**Severity (CVSS):** Low  
**Affected plugin: dbCharts**  
**Description:**

dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file hudson.plugins.dbcharts.DbChartPublisher.xml on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with access to the Jenkins controller file system.

**Passwords stored in plain text by Vmware vRealize CodeStream Plugin**

**SECURITY-2238 / CVE-2022-27217**  
**Severity (CVSS):** Medium  
**Affected plugin: vmware-vrealize-codestream**  
**Description:**

Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

**Personal tokens stored in plain text by incapptic connect uploader Plugin**

**SECURITY-2273 / CVE-2022-27218**  
**Severity (CVSS):** Medium  
**Affected plugin: incapptic-connect-uploader**  
**Description:**

incapptic connect uploader Plugin 1.15 and earlier stores personal tokens unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

**Severity**

*   SECURITY-1350: Medium
*   SECURITY-1351: Medium
*   SECURITY-1886: Medium
*   SECURITY-1891: Low
*   SECURITY-2096: Medium
*   SECURITY-2124: High
*   SECURITY-2159: Low
*   SECURITY-2167: High
*   SECURITY-2185: Low
*   SECURITY-2232: High
*   SECURITY-2238: Medium
*   SECURITY-2252: High
*   SECURITY-2273: Medium
*   SECURITY-2274: Medium
*   SECURITY-2351: Medium
*   SECURITY-2557: High
*   SECURITY-2559: High
*   SECURITY-2636: Medium
*   SECURITY-2646: Medium
*   SECURITY-2681: High

**Affected Versions**

*   **CloudBees AWS Credentials Plugin** up to and including 189.v3551d5642995
*   **Dashboard View Plugin** up to and including 2.18
*   **dbCharts Plugin** up to and including 0.5.2
*   **Environment Dashboard Plugin** up to and including 1.1.10
*   **Extended Choice Parameter Plugin** up to and including 346.vd87693c5a\_86c
*   **Favorite Plugin** up to and including 2.4.0
*   **Folder-based Authorization Strategy Plugin** up to and including 1.3
*   **GitLab Authentication Plugin** up to and including 1.13
*   **global-build-stats Plugin** up to and including 1.5
*   **incapptic connect uploader Plugin** up to and including 1.15
*   **kubernetes-cd Plugin** up to and including 2.3.1
*   **List Git Branches Parameter Plugin** up to and including 0.0.9
*   **Parameterized Trigger Plugin** up to and including 2.43
*   **Release Helper Plugin** up to and including 1.3.3
*   **Semantic Versioning Plugin** up to and including 1.13
*   **Vmware vRealize CodeStream Plugin** up to and including 1.2

**Fix**

*   **CloudBees AWS Credentials Plugin** should be updated to version 191.vcb\_f183ce58b\_9
*   **Dashboard View Plugin** should be updated to version 2.18.1
*   **Favorite Plugin** should be updated to version 2.4.1
*   **Folder-based Authorization Strategy Plugin** should be updated to version 1.4
*   **Parameterized Trigger Plugin** should be updated to version 2.43.1
*   **Semantic Versioning Plugin** should be updated to version 1.14

These versions include fixes to the vulnerabilities described above. All prior versions are considered to be affected by these vulnerabilities unless otherwise indicated.

As of publication of this advisory, no fixes are available for the following plugins:

*   dbCharts Plugin
*   Environment Dashboard Plugin
*   Extended Choice Parameter Plugin
*   GitLab Authentication Plugin
*   global-build-stats Plugin
*   incapptic connect uploader Plugin
*   kubernetes-cd Plugin
*   List Git Branches Parameter Plugin
*   Release Helper Plugin
*   Vmware vRealize CodeStream Plugin

Learn why we announce these issues.

**Credit**

The Jenkins project would like to thank the reporters for discovering and reporting these vulnerabilities:

*   **Daniel Beck, CloudBees, Inc.** for SECURITY-2124, SECURITY-2681
*   **Gunther Rademacher** for SECURITY-2185
*   **Jesse Glick, CloudBees, Inc.** for SECURITY-2096
*   **Justin Philip** for SECURITY-2252
*   **Kevin Guerroudj** for SECURITY-2232, SECURITY-2238
*   **Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2636, SECURITY-2646
*   **Kevin Guerroudj, CloudBees, Inc. and Wadeck Follonier, CloudBees, Inc.** for SECURITY-2557
*   **Matt Sicker, CloudBees, Inc. and, independently, Marc Heyries** for SECURITY-1891
*   **Oleg Nenashev, CloudBees, Inc.** for SECURITY-1350, SECURITY-1351
*   **Quentin Parra** for SECURITY-2273, SECURITY-2274
*   **Son Nguyen (@s0nnguy3n\_)** for SECURITY-2159
*   **Son Nguyen (@s0nnguy3n\_), and, independently, Kevin Guerroudj** for SECURITY-2167
*   **Wadeck Follonier, CloudBees, Inc. and Kevin Guerroudj, CloudBees, Inc.** for SECURITY-2559
*   **Wadeck Follonier, CloudBees, Inc., and, independently, Kevin Guerroudj** for SECURITY-1886

CVE-2022-27205: Jenkins Security Advisory 2022-03-15

Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

CVE-2022-27200: Jenkins Security Advisory 2022-03-15

A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.

Tag

#vmware