Cross-site Scripting in Jenkins Blue Ocean Plugin

2022-05-1301:31:35

Google

osv.dev

jenkins

blue ocean

cross-site scripting

vulnerability

html

user description

permission

plugin

EPSS

0.001

Percentile

25.8%

JSON

A cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier that allows attackers with permission to edit a user’s description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.
This vulnerability is found in:

blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java
blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java
blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java
blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java
blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly