Stored XSS vulnerability in Jenkins Scriptler Plugin

2022-01-0618:45:09

Google

osv.dev

0.001 Low

EPSS

Percentile

22.3%

JSON

Jenkins Scriptler Plugin 3.1 and earlier does not escape script content.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.

Jenkins Scriptler Plugin 3.2 escapes script content.

CPENameOperatorVersion
org.jenkins-ci.plugins:scriptlereq2.3
org.jenkins-ci.plugins:scriptlereq2.2
org.jenkins-ci.plugins:scriptlereq2.0
org.jenkins-ci.plugins:scriptlereq3.1
org.jenkins-ci.plugins:scriptlereq2.6.1
org.jenkins-ci.plugins:scriptlereq3.0-alpha
org.jenkins-ci.plugins:scriptlereq2.4
org.jenkins-ci.plugins:scriptlereq2.5.1
org.jenkins-ci.plugins:scriptlereq2.1
org.jenkins-ci.plugins:scriptlereq2.7

Name	Operator	Version
org.jenkins-ci.plugins:scriptler	eq	2.3
org.jenkins-ci.plugins:scriptler	eq	2.2
org.jenkins-ci.plugins:scriptler	eq	2.0
org.jenkins-ci.plugins:scriptler	eq	3.1
org.jenkins-ci.plugins:scriptler	eq	2.6.1
org.jenkins-ci.plugins:scriptler	eq	3.0-alpha
org.jenkins-ci.plugins:scriptler	eq	2.4
org.jenkins-ci.plugins:scriptler	eq	2.5.1
org.jenkins-ci.plugins:scriptler	eq	2.1
org.jenkins-ci.plugins:scriptler	eq	2.7