Stored Cross-site Scripting vulnerability in Jenkins Folder-based Authorization Strategy Plugin

2022-03-1600:00:44

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

CPENameOperatorVersion
io.jenkins.plugins:folder-autheq1.1
io.jenkins.plugins:folder-autheq1.3
io.jenkins.plugins:folder-autheq0.1-alpha-2
io.jenkins.plugins:folder-autheq1.0.2
io.jenkins.plugins:folder-autheq1.0
io.jenkins.plugins:folder-autheq1.0.1
io.jenkins.plugins:folder-autheq1.0-beta-1
io.jenkins.plugins:folder-autheq1.2
io.jenkins.plugins:folder-autheq0.1-alpha-1

Name	Operator	Version
io.jenkins.plugins:folder-auth	eq	1.1
io.jenkins.plugins:folder-auth	eq	1.3
io.jenkins.plugins:folder-auth	eq	0.1-alpha-2
io.jenkins.plugins:folder-auth	eq	1.0.2
io.jenkins.plugins:folder-auth	eq	1.0
io.jenkins.plugins:folder-auth	eq	1.0.1
io.jenkins.plugins:folder-auth	eq	1.0-beta-1
io.jenkins.plugins:folder-auth	eq	1.2
io.jenkins.plugins:folder-auth	eq	0.1-alpha-1