Jenkins Pipeline Aggregator View Plugin vulnerable to Cross-site Scripting

2023-04-0221:30:17

CWE-79

GitHub Advisory Database

github.com

jenkins pipeline

aggregator view plugin

cross-site scripting

xss

vulnerability

authentication

overall/read permission

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

32.2%

JSON

Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view’s URL in inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission. Version 1.14 obtains the current URL in a way not susceptible to XSS.

Affected configurations

Vulners

Node

com.paul8620.jenkins.pluginspipeline-aggregator-viewRange<1.14

VendorProductVersionCPE
com.paul8620.jenkins.pluginspipeline-aggregator-view*cpe:2.3:a:com.paul8620.jenkins.plugins:pipeline-aggregator-view:*:*:*:*:*:*:*:*