Promotion names in Jenkins promoted builds Plugin are not validated when using Job DSL

2022-04-1300:00:16

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins promoted builds Plugin provides dedicated support for defining promotions using Job DSL Plugin.

promoted builds Plugin 873.v6149db_d64130 and earlier does not validate the names of promotions defined in Job DSL. This allows attackers with Job/Configure permission to create a promotion with an unsafe name. As a result, the promotion name could be used for cross-site scripting (XSS) or to replace other config.xml files.

promoted builds Plugin 876.v99d29788b_36b_ and 3.10.1 validates the name of promotions.

CPENameOperatorVersion
org.jenkins-ci.plugins:promoted-buildseq2.22-beta1
org.jenkins-ci.plugins:promoted-buildseq2.6
org.jenkins-ci.plugins:promoted-buildseq3.5.1
org.jenkins-ci.plugins:promoted-buildseq873.v6149db_d64130
org.jenkins-ci.plugins:promoted-buildseq2.5
org.jenkins-ci.plugins:promoted-buildseq2.17
org.jenkins-ci.plugins:promoted-buildseq2.29
org.jenkins-ci.plugins:promoted-buildseq2.4
org.jenkins-ci.plugins:promoted-buildseq2.7
org.jenkins-ci.plugins:promoted-buildseq2.30

Name	Operator	Version
org.jenkins-ci.plugins:promoted-builds	eq	2.22-beta1
org.jenkins-ci.plugins:promoted-builds	eq	2.6
org.jenkins-ci.plugins:promoted-builds	eq	3.5.1
org.jenkins-ci.plugins:promoted-builds	eq	873.v6149db_d64130
org.jenkins-ci.plugins:promoted-builds	eq	2.5
org.jenkins-ci.plugins:promoted-builds	eq	2.17
org.jenkins-ci.plugins:promoted-builds	eq	2.29
org.jenkins-ci.plugins:promoted-builds	eq	2.4
org.jenkins-ci.plugins:promoted-builds	eq	2.7
org.jenkins-ci.plugins:promoted-builds	eq	2.30