CVE-2022-27197

2022-03-1517:15:10

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet’s Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.

CPENameOperatorVersion
dashboard-view-plugineqdashboard-view-2.0.1
dashboard-view-plugineqdashboard-view-2.1
dashboard-view-plugineqdashboard-view-2.9.2
dashboard-view-plugineqdashboard-view-2.10
dashboard-view-plugineqdashboard-view-2.9.10
dashboard-view-plugineqdashboard-view-2.9.7
dashboard-view-plugineqdashboard-view-2.9.11
dashboard-view-plugineqdashboard-view-2.5
dashboard-view-plugineqdashboard-view-2.18
dashboard-view-plugineqdashboard-view-2.9

Name	Operator	Version
dashboard-view-plugin	eq	dashboard-view-2.0.1
dashboard-view-plugin	eq	dashboard-view-2.1
dashboard-view-plugin	eq	dashboard-view-2.9.2
dashboard-view-plugin	eq	dashboard-view-2.10
dashboard-view-plugin	eq	dashboard-view-2.9.10
dashboard-view-plugin	eq	dashboard-view-2.9.7
dashboard-view-plugin	eq	dashboard-view-2.9.11
dashboard-view-plugin	eq	dashboard-view-2.5
dashboard-view-plugin	eq	dashboard-view-2.18
dashboard-view-plugin	eq	dashboard-view-2.9