CVE-2022-43435: 
Java vulnerability analysis and mitigation

Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download. The vulnerability was discovered and disclosed on October 19, 2022, affecting all versions up to and including 1.7.2 (Jenkins Advisory, OSS Security).

The vulnerability occurs when the 'Execute FireLine' build step is executed with the option 'Open access to HTML with JS or CSS' checked. The plugin globally disables the Content-Security-Policy header for static files served by Jenkins (specifically DirectoryBrowserSupport), such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. The vulnerability has been assigned a CVSS severity rating of High (Jenkins Advisory).

This vulnerability allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc. Jenkins instances with Resource Root URL configured are unaffected (Jenkins Advisory).

The vulnerability can be exploited by attackers who have the ability to control files in workspaces or archived artifacts, and requires the 'Open access to HTML with JS or CSS' option to be checked in the 'Execute FireLine' build step (Jenkins Advisory).

As of the advisory publication date, there was no fix available for this vulnerability. Administrators can mitigate the risk by configuring a Resource Root URL in Jenkins, which prevents the vulnerability from being exploited (Jenkins Advisory).