Stored XSS vulnerability in Jenkins Git Changelog Plugin

2022-05-1301:30:26

Google

osv.dev

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.5%

JSON

A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, GitLogBasicChangelogPostPublisher/config.jelly that allows attackers able to control the Git history parsed by the plugin to have Jenkins render arbitrary HTML on some pages.

CPENameOperatorVersion
de.wellnerbou.jenkins:git-changelogeq1.28
de.wellnerbou.jenkins:git-changelogeq1.18
de.wellnerbou.jenkins:git-changelogeq2.5
de.wellnerbou.jenkins:git-changelogeq1.1
de.wellnerbou.jenkins:git-changelogeq2.6
de.wellnerbou.jenkins:git-changelogeq1.23
de.wellnerbou.jenkins:git-changelogeq1.11
de.wellnerbou.jenkins:git-changelogeq1.22
de.wellnerbou.jenkins:git-changelogeq1.40
de.wellnerbou.jenkins:git-changelogeq1.5

Name	Operator	Version
de.wellnerbou.jenkins:git-changelog	eq	1.28
de.wellnerbou.jenkins:git-changelog	eq	1.18
de.wellnerbou.jenkins:git-changelog	eq	2.5
de.wellnerbou.jenkins:git-changelog	eq	1.1
de.wellnerbou.jenkins:git-changelog	eq	2.6
de.wellnerbou.jenkins:git-changelog	eq	1.23
de.wellnerbou.jenkins:git-changelog	eq	1.11
de.wellnerbou.jenkins:git-changelog	eq	1.22
de.wellnerbou.jenkins:git-changelog	eq	1.40
de.wellnerbou.jenkins:git-changelog	eq	1.5