Cross site scripting in Jenkins Mission Control Plugin

2022-05-2417:03:48

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to change these properties.

CPENameOperatorVersion
tech.andrey.jenkins:mission-control-vieweq0.9.7
tech.andrey.jenkins:mission-control-vieweq0.9.2
tech.andrey.jenkins:mission-control-vieweq0.9.9
tech.andrey.jenkins:mission-control-vieweq0.9.0
tech.andrey.jenkins:mission-control-vieweq0.9.13
tech.andrey.jenkins:mission-control-vieweq0.9.11
tech.andrey.jenkins:mission-control-vieweq0.9.8
tech.andrey.jenkins:mission-control-vieweq0.9.10
tech.andrey.jenkins:mission-control-vieweq0.9.16
tech.andrey.jenkins:mission-control-vieweq0.9.14

Name	Operator	Version
tech.andrey.jenkins:mission-control-view	eq	0.9.7
tech.andrey.jenkins:mission-control-view	eq	0.9.2
tech.andrey.jenkins:mission-control-view	eq	0.9.9
tech.andrey.jenkins:mission-control-view	eq	0.9.0
tech.andrey.jenkins:mission-control-view	eq	0.9.13
tech.andrey.jenkins:mission-control-view	eq	0.9.11
tech.andrey.jenkins:mission-control-view	eq	0.9.8
tech.andrey.jenkins:mission-control-view	eq	0.9.10
tech.andrey.jenkins:mission-control-view	eq	0.9.16
tech.andrey.jenkins:mission-control-view	eq	0.9.14