CVE-2022-28149

2022-03-2913:15:09

Google

osv.dev

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CPENameOperatorVersion
ownership-plugineqownership-0.3
ownership-plugineqownership-0.12.1
ownership-plugineqownership-0.9.1
ownership-plugineqownership-0.5.1
ownership-plugineqownership-0.9.0-beta-1
ownership-plugineqownership-0.6
ownership-plugineqownership-0.13.0
ownership-plugineqownership-0.1.0
ownership-plugineqownership-0.5
ownership-plugineqownership-0.2.1

Name	Operator	Version
ownership-plugin	eq	ownership-0.3
ownership-plugin	eq	ownership-0.12.1
ownership-plugin	eq	ownership-0.9.1
ownership-plugin	eq	ownership-0.5.1
ownership-plugin	eq	ownership-0.9.0-beta-1
ownership-plugin	eq	ownership-0.6
ownership-plugin	eq	ownership-0.13.0
ownership-plugin	eq	ownership-0.1.0
ownership-plugin	eq	ownership-0.5
ownership-plugin	eq	ownership-0.2.1