Stored XSS vulnerability in Jenkins Scriptler Plugin

2022-01-0618:45:29

Google

osv.dev

0.001 Low

EPSS

Percentile

22.3%

JSON

Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.

Jenkins Scriptler Plugin 3.3 escapes parameter names shown in job configuration forms.

CPENameOperatorVersion
org.jenkins-ci.plugins:scriptlereq2.3
org.jenkins-ci.plugins:scriptlereq2.2
org.jenkins-ci.plugins:scriptlereq2.0
org.jenkins-ci.plugins:scriptlereq3.1
org.jenkins-ci.plugins:scriptlereq2.6.1
org.jenkins-ci.plugins:scriptlereq3.2
org.jenkins-ci.plugins:scriptlereq3.0-alpha
org.jenkins-ci.plugins:scriptlereq2.4
org.jenkins-ci.plugins:scriptlereq2.5.1
org.jenkins-ci.plugins:scriptlereq2.1

Name	Operator	Version
org.jenkins-ci.plugins:scriptler	eq	2.3
org.jenkins-ci.plugins:scriptler	eq	2.2
org.jenkins-ci.plugins:scriptler	eq	2.0
org.jenkins-ci.plugins:scriptler	eq	3.1
org.jenkins-ci.plugins:scriptler	eq	2.6.1
org.jenkins-ci.plugins:scriptler	eq	3.2
org.jenkins-ci.plugins:scriptler	eq	3.0-alpha
org.jenkins-ci.plugins:scriptler	eq	2.4
org.jenkins-ci.plugins:scriptler	eq	2.5.1
org.jenkins-ci.plugins:scriptler	eq	2.1