Stored XSS vulnerability in Jenkins Git Parameter Plugin

2022-04-1300:00:17

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CPENameOperatorVersion
org.jenkins-ci.tools:git-parametereq0.6.0
org.jenkins-ci.tools:git-parametereq0.9.1
org.jenkins-ci.tools:git-parametereq0.9.9
org.jenkins-ci.tools:git-parametereq0.9.11
org.jenkins-ci.tools:git-parametereq0.6.1
org.jenkins-ci.tools:git-parametereq0.6.2
org.jenkins-ci.tools:git-parametereq0.9.15
org.jenkins-ci.tools:git-parametereq0.7.0
org.jenkins-ci.tools:git-parametereq0.9.2
org.jenkins-ci.tools:git-parametereq0.9.3

Name	Operator	Version
org.jenkins-ci.tools:git-parameter	eq	0.6.0
org.jenkins-ci.tools:git-parameter	eq	0.9.1
org.jenkins-ci.tools:git-parameter	eq	0.9.9
org.jenkins-ci.tools:git-parameter	eq	0.9.11
org.jenkins-ci.tools:git-parameter	eq	0.6.1
org.jenkins-ci.tools:git-parameter	eq	0.6.2
org.jenkins-ci.tools:git-parameter	eq	0.9.15
org.jenkins-ci.tools:git-parameter	eq	0.7.0
org.jenkins-ci.tools:git-parameter	eq	0.9.2
org.jenkins-ci.tools:git-parameter	eq	0.9.3