Jenkins GitBucket Plugin vulnerable to stored Cross-site Scripting

2024-03-0618:30:38

Google

osv.dev

jenkins

gitbucket

xss

vulnerability

software

build views

cross-site scripting

5.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.

CPENameOperatorVersion
org.jenkins-ci.plugins:gitbucketeq0.2
org.jenkins-ci.plugins:gitbucketeq0.3
org.jenkins-ci.plugins:gitbucketeq0.7
org.jenkins-ci.plugins:gitbucketeq0.6
org.jenkins-ci.plugins:gitbucketeq0.8
org.jenkins-ci.plugins:gitbucketeq0.1
org.jenkins-ci.plugins:gitbucketeq0.5.1
org.jenkins-ci.plugins:gitbucketeq0.4

Name	Operator	Version
org.jenkins-ci.plugins:gitbucket	eq	0.2
org.jenkins-ci.plugins:gitbucket	eq	0.3
org.jenkins-ci.plugins:gitbucket	eq	0.7
org.jenkins-ci.plugins:gitbucket	eq	0.6
org.jenkins-ci.plugins:gitbucket	eq	0.8
org.jenkins-ci.plugins:gitbucket	eq	0.1
org.jenkins-ci.plugins:gitbucket	eq	0.5.1
org.jenkins-ci.plugins:gitbucket	eq	0.4