Cross-site scripting in Jenkins Kiuwan Plugin

2021-06-1617:10:50

Google

osv.dev

0.001 Low

EPSS

Percentile

36.3%

JSON

Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.

Only older releases of Jenkins are affected by this vulnerability. Jenkins 2.275 and newer, LTS 2.263.2 and newer include a protection preventing this from being exploitable.

Jenkins Kiuwan Plugin 1.6.1 escapes affected parts of the error message in the form validation endpoint.

CPENameOperatorVersion
org.jenkins-ci.plugins:kiuwanjenkinsplugineq1.4.2
org.jenkins-ci.plugins:kiuwanjenkinsplugineq1.4.1
org.jenkins-ci.plugins:kiuwanjenkinsplugineq1.3.2
org.jenkins-ci.plugins:kiuwanjenkinsplugineq1.5.1
org.jenkins-ci.plugins:kiuwanjenkinsplugineq1.3.5
org.jenkins-ci.plugins:kiuwanjenkinsplugineq1.1
org.jenkins-ci.plugins:kiuwanjenkinsplugineq1.3.3
org.jenkins-ci.plugins:kiuwanjenkinsplugineq1.0
org.jenkins-ci.plugins:kiuwanjenkinsplugineq1.4.4
org.jenkins-ci.plugins:kiuwanjenkinsplugineq1.5.2

Name	Operator	Version
org.jenkins-ci.plugins:kiuwanjenkinsplugin	eq	1.4.2
org.jenkins-ci.plugins:kiuwanjenkinsplugin	eq	1.4.1
org.jenkins-ci.plugins:kiuwanjenkinsplugin	eq	1.3.2
org.jenkins-ci.plugins:kiuwanjenkinsplugin	eq	1.5.1
org.jenkins-ci.plugins:kiuwanjenkinsplugin	eq	1.3.5
org.jenkins-ci.plugins:kiuwanjenkinsplugin	eq	1.1
org.jenkins-ci.plugins:kiuwanjenkinsplugin	eq	1.3.3
org.jenkins-ci.plugins:kiuwanjenkinsplugin	eq	1.0
org.jenkins-ci.plugins:kiuwanjenkinsplugin	eq	1.4.4
org.jenkins-ci.plugins:kiuwanjenkinsplugin	eq	1.5.2