Jenkins Delivery Pipeline Plugin Cross-site Scripting vulnerability

2022-05-1403:45:38

Google

osv.dev

0.001 Low

EPSS

Percentile

32.9%

JSON

The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter ‘fullscreen’ in its JavaScript, resulting in a cross-site scripting vulnerability through specially crafted URLs. Version 1.0.8 of the plugin converts the value to a boolean (true/false) and inserts that into the page instead.

CPENameOperatorVersion
se.diabol.jenkins.pipeline:delivery-pipeline-plugineq0.8.7
se.diabol.jenkins.pipeline:delivery-pipeline-plugineq0.9.8
se.diabol.jenkins.pipeline:delivery-pipeline-plugineq1.0.6
se.diabol.jenkins.pipeline:delivery-pipeline-plugineq0.6.4
se.diabol.jenkins.pipeline:delivery-pipeline-plugineq0.6.2
se.diabol.jenkins.pipeline:delivery-pipeline-plugineq0.9.7
se.diabol.jenkins.pipeline:delivery-pipeline-plugineq0.7.0
se.diabol.jenkins.pipeline:delivery-pipeline-plugineq0.8.4
se.diabol.jenkins.pipeline:delivery-pipeline-plugineq0.6.1
se.diabol.jenkins.pipeline:delivery-pipeline-plugineq0.8.1

Name	Operator	Version
se.diabol.jenkins.pipeline:delivery-pipeline-plugin	eq	0.8.7
se.diabol.jenkins.pipeline:delivery-pipeline-plugin	eq	0.9.8
se.diabol.jenkins.pipeline:delivery-pipeline-plugin	eq	1.0.6
se.diabol.jenkins.pipeline:delivery-pipeline-plugin	eq	0.6.4
se.diabol.jenkins.pipeline:delivery-pipeline-plugin	eq	0.6.2
se.diabol.jenkins.pipeline:delivery-pipeline-plugin	eq	0.9.7
se.diabol.jenkins.pipeline:delivery-pipeline-plugin	eq	0.7.0
se.diabol.jenkins.pipeline:delivery-pipeline-plugin	eq	0.8.4
se.diabol.jenkins.pipeline:delivery-pipeline-plugin	eq	0.6.1
se.diabol.jenkins.pipeline:delivery-pipeline-plugin	eq	0.8.1