GHSA-V98R-GJGC-M9PF Stored Cross-site Scripting vulnerability in Jenkins Promoted Builds Plugin

🗓️ 13 Apr 2022 00:00:16Reported by GoogleType

osv🔗 osv.dev👁 29 Views

Stored Cross-site Scripting vulnerability in Jenkins Promoted Builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not escape the name and description of Promoted Build parameters resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Exploitation of these vulnerabilities requires that parameters are listed on another page, like the "Build With Parameters" and "Parameters" pages provided by Jenkins (core). Jenkins (core) has prevented exploitation of vulnerabilities of this kind since 2.44 and LTS 2.32.2

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2022-29045	12 Apr 202220:15	–	attackerkb
AlpineLinux	CVE-2022-29045	12 Apr 202200:00	–	alpinelinux
Tenable Nessus	Jenkins Enterprise and Operations Center 2.303.x < 2.303.30.0.10 / 2.332.2.6 Multiple Vulnerabilities (CloudBees Security Advisory 2022-04-12)	16 May 202200:00	–	nessus
Tenable Nessus	Jenkins plugins Multiple Vulnerabilities (2022-04-12)	23 May 202200:00	–	nessus
CNNVD	Jenkins 跨站脚本漏洞	12 Apr 202200:00	–	cnnvd
CNVD	Jenkins promoted builds Plugin cross-site scripting vulnerability	13 Apr 202200:00	–	cnvd
CVE	CVE-2022-29045	12 Apr 202200:00	–	cve
Cvelist	CVE-2022-29045	12 Apr 202200:00	–	cvelist
Github Security Blog	Stored Cross-site Scripting vulnerability in Jenkins Promoted Builds Plugin	13 Apr 202200:00	–	github
NVD	CVE-2022-29045	12 Apr 202220:15	–	nvd