Jenkins Job Config History Plugin reflected XSS vulnerability

2022-05-1400:53:49

Google

osv.dev

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.2%

JSON

A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arbitrary attacker-specified HTML in Jenkins to users with Job/Configure access.

CPENameOperatorVersion
org.jenkins-ci.plugins:jobconfighistoryeq2.8
org.jenkins-ci.plugins:jobconfighistoryeq2.5
org.jenkins-ci.plugins:jobconfighistoryeq1.11
org.jenkins-ci.plugins:jobconfighistoryeq2.6
org.jenkins-ci.plugins:jobconfighistoryeq1.13
org.jenkins-ci.plugins:jobconfighistoryeq2.11
org.jenkins-ci.plugins:jobconfighistoryeq2.18
org.jenkins-ci.plugins:jobconfighistoryeq2.15
org.jenkins-ci.plugins:jobconfighistoryeq2.13
org.jenkins-ci.plugins:jobconfighistoryeq2.2

Name	Operator	Version
org.jenkins-ci.plugins:jobconfighistory	eq	2.8
org.jenkins-ci.plugins:jobconfighistory	eq	2.5
org.jenkins-ci.plugins:jobconfighistory	eq	1.11
org.jenkins-ci.plugins:jobconfighistory	eq	2.6
org.jenkins-ci.plugins:jobconfighistory	eq	1.13
org.jenkins-ci.plugins:jobconfighistory	eq	2.11
org.jenkins-ci.plugins:jobconfighistory	eq	2.18
org.jenkins-ci.plugins:jobconfighistory	eq	2.15
org.jenkins-ci.plugins:jobconfighistory	eq	2.13
org.jenkins-ci.plugins:jobconfighistory	eq	2.2