Stored XSS vulnerabilities in multiple plugins providing additional parameter types

🗓️ 22 Jun 2022 00:00:00Reported by Jenkins Security TeamType

jenkins

jenkins🔗 www.jenkins.io👁 2 Views

Stored cross site scripting in Jenkins plugins that add parameter types; requires listing on parameters pages.

Reporter	Title	Published	Views	Family All 200
ATTACKERKB	CVE-2022-34184	23 Jun 202217:15	–	attackerkb
ATTACKERKB	CVE-2022-34198	23 Jun 202217:15	–	attackerkb
ATTACKERKB	CVE-2022-34192	23 Jun 202217:15	–	attackerkb
ATTACKERKB	CVE-2022-34183	23 Jun 202217:15	–	attackerkb
ATTACKERKB	CVE-2022-34186	23 Jun 202217:15	–	attackerkb
ATTACKERKB	CVE-2022-34188	23 Jun 202217:15	–	attackerkb
ATTACKERKB	CVE-2022-34190	23 Jun 202217:15	–	attackerkb
ATTACKERKB	CVE-2022-34191	23 Jun 202217:15	–	attackerkb
ATTACKERKB	CVE-2022-34196	23 Jun 202217:15	–	attackerkb
ATTACKERKB	CVE-2022-34193	23 Jun 202217:15	–	attackerkb

Vulners

Node

jenkins agent-server-parameterRange≤1.1jenkins

OR

jenkins crx-content-package-deployerRange≤1.9jenkins

OR

jenkins date-parameterRange≤0.0.4jenkins

OR

jenkins dynamic_extended_choice_parameterRange≤1.0.1jenkins

OR

jenkins filesystem-list-parameter-pluginRange≤0.0.7jenkins

OR

jenkins hidden-parameterRange<0.0.5jenkins

OR

jenkins image-tag-parameterRange≤1.10jenkins

OR

jenkins maven-metadata-pluginRange≤2.1jenkins

OR

jenkins cavisson-ns-nd-integrationRange≤4.8.0.77jenkins

OR

jenkins ontrackRange≤4.0.0jenkins

OR

jenkins packageversionRange≤1.0.1jenkins

OR

jenkins readonly-parametersRange≤1.0.0jenkins

OR

jenkins repository-connectorRange≤2.2.0jenkins

OR

jenkins rest-list-parameterRange<1.6.0jenkins

OR

jenkins sauce-ondemandRange≤1.204jenkins

OR

jenkins stashbranchparameterRange≤0.3.0jenkins

22 Jun 2022 00:00Current

5.4Medium risk

Vulners AI Score5.4

CVSS 23.5

CVSS 3.15.4 - 8

EPSS0.00753

cross site scripting jenkins plugins parameter types security vulnerabilities build with parameters