Reflected XSS vulnerability in Jenkins VncViewer Plugin

2022-05-2417:22:19

Google

osv.dev

0.001 Low

EPSS

Percentile

36.3%

JSON

VncViewer Plugin 1.7 and earlier does not escape a parameter value in the checkVncServ form validation endpoint output.

This results in a reflected cross-site scripting (XSS) vulnerability.

VncViewer Plugin 1.8 escapes the parameter value in the output.

CPENameOperatorVersion
org.jenkins-ci.plugins:vncviewereq1.5
org.jenkins-ci.plugins:vncviewereq1.7
org.jenkins-ci.plugins:vncviewereq1.2
org.jenkins-ci.plugins:vncviewereq1.3
org.jenkins-ci.plugins:vncviewereq1.1
org.jenkins-ci.plugins:vncviewereq1.0

Name	Operator	Version
org.jenkins-ci.plugins:vncviewer	eq	1.5
org.jenkins-ci.plugins:vncviewer	eq	1.7
org.jenkins-ci.plugins:vncviewer	eq	1.2
org.jenkins-ci.plugins:vncviewer	eq	1.3
org.jenkins-ci.plugins:vncviewer	eq	1.1
org.jenkins-ci.plugins:vncviewer	eq	1.0