GitHub Advisory DatabaseGHSA-MV77-FJ63-Q5W8Stored XSS vulnerability in Jenkins GitHub Plugin
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
38.8%
Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
GitHub Plugin 1.37.3.1 escapes GitHub project URL on the build page when showing changes.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| com.coravy.hudson.plugins.github:github | lt | 1.37.3.1 |
Related
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
38.8%