Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2022-43433: Jenkins ScreenRecorder Plugin: User-Generated Content Leaked to Download
CVE-2022-43433 · published 4 years ago
Summary
The Jenkins ScreenRecorder Plugin for versions up to 0.7 does not protect user-generated content, making it accessible for download. This can expose sensitive data to unauthorized parties. Update the plugin to a version 0.8 or later to fix this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | jenkins | io.jenkins.plugins:screenrecorder | <= 0.7 |
| – | jenkins | screenrecorder |
<= 0.7 cpe:2.3:a:jenkins:screenrecorder:*:*:*:*:*:jenkins:*:* |
Original advisory text
Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for...
Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
4.3
Medium
Type
CWE-693Protection Mechanism Failure
Timeline
Published19 Oct 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta