Stored Cross-site Scripting vulnerability in Jenkins Favorite Plugin

2022-03-1600:00:45

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.

CPENameOperatorVersion
org.jvnet.hudson.plugins:favoriteeq2.4.0
org.jvnet.hudson.plugins:favoriteeq1.3
org.jvnet.hudson.plugins:favoriteeq2.0
org.jvnet.hudson.plugins:favoriteeq1.8
org.jvnet.hudson.plugins:favoriteeq2.3.3.1
org.jvnet.hudson.plugins:favoriteeq2.3.2
org.jvnet.hudson.plugins:favoriteeq2.0.1
org.jvnet.hudson.plugins:favoriteeq2.1.0
org.jvnet.hudson.plugins:favoriteeq2.2.0
org.jvnet.hudson.plugins:favoriteeq1.11

Name	Operator	Version
org.jvnet.hudson.plugins:favorite	eq	2.4.0
org.jvnet.hudson.plugins:favorite	eq	1.3
org.jvnet.hudson.plugins:favorite	eq	2.0
org.jvnet.hudson.plugins:favorite	eq	1.8
org.jvnet.hudson.plugins:favorite	eq	2.3.3.1
org.jvnet.hudson.plugins:favorite	eq	2.3.2
org.jvnet.hudson.plugins:favorite	eq	2.0.1
org.jvnet.hudson.plugins:favorite	eq	2.1.0
org.jvnet.hudson.plugins:favorite	eq	2.2.0
org.jvnet.hudson.plugins:favorite	eq	1.11