Jenkins buildgraph-view Plugin vulnerable to stored Cross-site Scripting

2022-05-2417:03:47

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored cross-site scripting vulnerability exploitable by users able to change build descriptions.

CPENameOperatorVersion
org.jenkins-ci.plugins:buildgraph-vieweq1.5.1
org.jenkins-ci.plugins:buildgraph-vieweq1.3.1
org.jenkins-ci.plugins:buildgraph-vieweq1.6
org.jenkins-ci.plugins:buildgraph-vieweq1.3
org.jenkins-ci.plugins:buildgraph-vieweq1.1
org.jenkins-ci.plugins:buildgraph-vieweq1.2
org.jenkins-ci.plugins:buildgraph-vieweq1.0
org.jenkins-ci.plugins:buildgraph-vieweq1.7
org.jenkins-ci.plugins:buildgraph-vieweq1.5.2
org.jenkins-ci.plugins:buildgraph-vieweq1.0.1

Name	Operator	Version
org.jenkins-ci.plugins:buildgraph-view	eq	1.5.1
org.jenkins-ci.plugins:buildgraph-view	eq	1.3.1
org.jenkins-ci.plugins:buildgraph-view	eq	1.6
org.jenkins-ci.plugins:buildgraph-view	eq	1.3
org.jenkins-ci.plugins:buildgraph-view	eq	1.1
org.jenkins-ci.plugins:buildgraph-view	eq	1.2
org.jenkins-ci.plugins:buildgraph-view	eq	1.0
org.jenkins-ci.plugins:buildgraph-view	eq	1.7
org.jenkins-ci.plugins:buildgraph-view	eq	1.5.2
org.jenkins-ci.plugins:buildgraph-view	eq	1.0.1