{"id":"GHSA-g66m-fqxf-3w35","summary":"CSRF protection for any URL can be bypassed in Jenkins Pipeline: Input Step Plugin","details":"Pipeline: Input Step Plugin 451.vf1a_a_4f405289 and earlier does not restrict or sanitize the optionally specified ID of the `input` step. This ID is used for the URLs that process user interactions for the given `input` step (proceed or abort) and is not correctly encoded.\n\nThis allows attackers able to configure Pipelines to have Jenkins build URLs from `input` step IDs that would bypass the CSRF protection of any target URL in Jenkins when the `input` step is interacted with.\n\nPipeline: Input Step Plugin 456.vd8a_957db_5b_e9 limits the characters that can be used for the ID of `input` steps in Pipelines to alphanumeric characters and URL-safe punctuation. Pipelines with `input` steps having IDs with prohibited characters will fail with an error.\n\nThis includes Pipelines that have already been started but not finished before Jenkins is restarted to apply this update.\n\n[Pipeline: Declarative Plugin](https://plugins.jenkins.io/pipeline-model-definition/) provides an `input` directive that is internally using the `input` step, and specifies a non-default ID if not user-defined. Pipeline: Declarative Plugin 2.2114.v2654ca_721309 and earlier may specify values incompatible with this new restriction on legal values: `input` directives in a `stage` use the stage name (which may include prohibited characters) and `input` directives in a `matrix` will use a value generated from the matrix axis values (which always includes prohibited characters). Administrators are advised to update Pipeline: Input Step Plugin and Pipeline: Declarative Plugin at the same time, ideally while no Pipelines are running.","aliases":["CVE-2022-43407"],"modified":"2025-05-08T22:35:16.402270Z","published":"2022-10-19T19:00:22Z","database_specific":{"nvd_published_at":"2022-10-19T16:15:00Z","cwe_ids":["CWE-352","CWE-838"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2022-10-19T21:21:29Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43407"},{"type":"WEB","url":"https://github.com/jenkinsci/pipeline-input-step-plugin/commit/d8a957db5be95ddfbf81f41a60b2f034000314b5"},{"type":"PACKAGE","url":"https://github.com/jenkinsci/pipeline-input-step-plugin"},{"type":"WEB","url":"https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2880"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2022/10/19/3"}],"affected":[{"package":{"name":"org.jenkins-ci.plugins:pipeline-input-step","ecosystem":"Maven","purl":"pkg:maven/org.jenkins-ci.plugins/pipeline-input-step"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"456.vd8a_957db_5b_e9"}]}],"versions":["2.0","2.1","2.10","2.11","2.12","2.12.1","2.12.2","2.2","2.3","2.4","2.5","2.6","2.7","2.8","2.9","427.va6441fa17010","446.vf27b_0b_83500e","447.449.v193fd29f6021","447.v95e5a_6e3502a_","448.v37cea_9a_10a_70","449.451.v9c3d42f23975","449.v77f0e8b_845c4","451.vf1a_a_4f405289"],"database_specific":{"last_known_affected_version_range":"\u003c 456.vd8a","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-g66m-fqxf-3w35/GHSA-g66m-fqxf-3w35.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}