Stored XSS vulnerability in Jenkins Static Analysis Utilities Plugin

2022-05-2417:33:08

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

CPENameOperatorVersion
org.jvnet.hudson.plugins:analysis-coreeq1.64
org.jvnet.hudson.plugins:analysis-coreeq1.15
org.jvnet.hudson.plugins:analysis-coreeq1.27
org.jvnet.hudson.plugins:analysis-coreeq1.4
org.jvnet.hudson.plugins:analysis-coreeq1.49
org.jvnet.hudson.plugins:analysis-coreeq1.91
org.jvnet.hudson.plugins:analysis-coreeq1.90
org.jvnet.hudson.plugins:analysis-coreeq1.37
org.jvnet.hudson.plugins:analysis-coreeq1.65
org.jvnet.hudson.plugins:analysis-coreeq1.56

Name	Operator	Version
org.jvnet.hudson.plugins:analysis-core	eq	1.64
org.jvnet.hudson.plugins:analysis-core	eq	1.15
org.jvnet.hudson.plugins:analysis-core	eq	1.27
org.jvnet.hudson.plugins:analysis-core	eq	1.4
org.jvnet.hudson.plugins:analysis-core	eq	1.49
org.jvnet.hudson.plugins:analysis-core	eq	1.91
org.jvnet.hudson.plugins:analysis-core	eq	1.90
org.jvnet.hudson.plugins:analysis-core	eq	1.37
org.jvnet.hudson.plugins:analysis-core	eq	1.65
org.jvnet.hudson.plugins:analysis-core	eq	1.56