Stored XSS vulnerability in Jenkins Release Plugin

2022-05-2417:30:18

Google

osv.dev

jenkins

release plugin

xss

vulnerability

stored

exploit

EPSS

0.001

Percentile

22.0%

JSON

Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Release/Release permission.

References

www.openwall.com/lists/oss-security/2020/10/08/5

github.com/jenkinsci/release-plugin

github.com/jenkinsci/release-plugin/commit/99814a0c82f5edf34ad297c2e98af9315bc6b5c2

nvd.nist.gov/vuln/detail/CVE-2020-2292

www.jenkins.io/security/advisory/2020-10-08/#SECURITY-1928

EPSS

0.001

Percentile

22.0%

JSON

Related for OSV:GHSA-VMG8-G8J3-M355