Stored Cross-site Scripting vulnerability in Jenkins Job and Node ownership Plugin

2022-03-3000:00:23

Google

osv.dev

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CPENameOperatorVersion
com.synopsys.jenkinsci:ownershipeq0.9.0
com.synopsys.jenkinsci:ownershipeq0.1.0
com.synopsys.jenkinsci:ownershipeq0.12.1
com.synopsys.jenkinsci:ownershipeq0.3
com.synopsys.jenkinsci:ownershipeq0.10.0
com.synopsys.jenkinsci:ownershipeq0.9.0-beta-1
com.synopsys.jenkinsci:ownershipeq0.2.1
com.synopsys.jenkinsci:ownershipeq0.4
com.synopsys.jenkinsci:ownershipeq0.12.0
com.synopsys.jenkinsci:ownershipeq0.5

Name	Operator	Version
com.synopsys.jenkinsci:ownership	eq	0.9.0
com.synopsys.jenkinsci:ownership	eq	0.1.0
com.synopsys.jenkinsci:ownership	eq	0.12.1
com.synopsys.jenkinsci:ownership	eq	0.3
com.synopsys.jenkinsci:ownership	eq	0.10.0
com.synopsys.jenkinsci:ownership	eq	0.9.0-beta-1
com.synopsys.jenkinsci:ownership	eq	0.2.1
com.synopsys.jenkinsci:ownership	eq	0.4
com.synopsys.jenkinsci:ownership	eq	0.12.0
com.synopsys.jenkinsci:ownership	eq	0.5