Cross-site Scripting in Jenkins Core

2022-05-1404:04:08

Google

osv.dev

0.001 Low

EPSS

Percentile

43.6%

JSON

Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form, as demonstrated by the JDK tool in Jenkins core and the Ant tool in the Ant plugin, aka SECURITY-624.

CPENameOperatorVersion
org.jenkins-ci.main:jenkins-coreeq2.60.3
org.jenkins-ci.main:jenkins-coreeq1.500
org.jenkins-ci.main:jenkins-coreeq1.571
org.jenkins-ci.main:jenkins-coreeq1.622
org.jenkins-ci.main:jenkins-coreeq2.75
org.jenkins-ci.main:jenkins-coreeq1.596.1
org.jenkins-ci.main:jenkins-coreeq1.510
org.jenkins-ci.main:jenkins-coreeq1.616
org.jenkins-ci.main:jenkins-coreeq1.566
org.jenkins-ci.main:jenkins-coreeq1.447

Name	Operator	Version
org.jenkins-ci.main:jenkins-core	eq	2.60.3
org.jenkins-ci.main:jenkins-core	eq	1.500
org.jenkins-ci.main:jenkins-core	eq	1.571
org.jenkins-ci.main:jenkins-core	eq	1.622
org.jenkins-ci.main:jenkins-core	eq	2.75
org.jenkins-ci.main:jenkins-core	eq	1.596.1
org.jenkins-ci.main:jenkins-core	eq	1.510
org.jenkins-ci.main:jenkins-core	eq	1.616
org.jenkins-ci.main:jenkins-core	eq	1.566
org.jenkins-ci.main:jenkins-core	eq	1.447