Lucene search

JenkinsCVELIST:CVE-2023-28670

HistoryMar 23, 2023 - 11:26 a.m.

CVE-2023-28670

2023-03-2311:26:00

jenkins

www.cve.org

jenkins

pipeline

aggregator

view

plugin

xss

cve-2023-28670

variable

javascript

cross-site scripting

authenticated

attackers

overall/read permission

AI Score

5.6

Confidence

High

EPSS

0.001

Percentile

32.2%

JSON

Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view’s URL in inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Jenkins Pipeline Aggregator View Plugin",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "lessThanOrEqual": "1.13",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]

References

www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2885