Stored XSS vulnerability in Jenkins Git Parameter Plugin

2022-05-2417:27:06

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the ‘Build with Parameters’ page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Git Parameter Plugin 0.9.13 escapes the repository field on the ‘Build with Parameters’ page.

CPENameOperatorVersion
org.jenkins-ci.tools:git-parametereq0.7.0
org.jenkins-ci.tools:git-parametereq0.9.7
org.jenkins-ci.tools:git-parametereq0.6.2
org.jenkins-ci.tools:git-parametereq0.8.1
org.jenkins-ci.tools:git-parametereq0.5.1
org.jenkins-ci.tools:git-parametereq0.9.10
org.jenkins-ci.tools:git-parametereq0.9.9
org.jenkins-ci.tools:git-parametereq0.7.2
org.jenkins-ci.tools:git-parametereq0.9.3
org.jenkins-ci.tools:git-parametereq0.9.0

Name	Operator	Version
org.jenkins-ci.tools:git-parameter	eq	0.7.0
org.jenkins-ci.tools:git-parameter	eq	0.9.7
org.jenkins-ci.tools:git-parameter	eq	0.6.2
org.jenkins-ci.tools:git-parameter	eq	0.8.1
org.jenkins-ci.tools:git-parameter	eq	0.5.1
org.jenkins-ci.tools:git-parameter	eq	0.9.10
org.jenkins-ci.tools:git-parameter	eq	0.9.9
org.jenkins-ci.tools:git-parameter	eq	0.7.2
org.jenkins-ci.tools:git-parameter	eq	0.9.3
org.jenkins-ci.tools:git-parameter	eq	0.9.0