Cross-Site Scripting (XSS)

2022-10-2014:53:10

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site scripting

jenkins-2-plugins

posthyperlinknote.java

build logs

malicious scripts

pipelines

vulnerability

urls

0.001 Low

EPSS

Percentile

33.4%

JSON

jenkins-2-plugins is vulnerable to Cross-Site Scripting (XSS). The vulnerability exists in extraAttributes of POSTHyperlinkNote.java because URLs of these hyperlinks in build logs are not properly encoded which allows an attacker to inject malicious scripts and create pipelines.

CPENameOperatorVersion
pipeline: supporting apisle838.va_3a_087b_4055b
jenkins-2-pluginseq4.9.1644822177__1.el8
jenkins-2-pluginseq4.10.1663599478__1.el8
jenkins-2-pluginseq4.10.1650890594__1.el8
jenkins-2-pluginseq4.10.1647505461__1.el8
jenkins-2-pluginseq4.10.1675936179__1.el8
jenkins-2-pluginseq4.6.1609853716__1.el8
jenkins-2-pluginseq4.9.1642607680__1.el8
jenkins-2-pluginseq4.10.1680703106__1.el8
jenkins-2-pluginseq4.9.1669894222__1.el8

Name	Operator	Version
pipeline: supporting apis	le	838.va_3a_087b_4055b
jenkins-2-plugins	eq	4.9.1644822177__1.el8
jenkins-2-plugins	eq	4.10.1663599478__1.el8
jenkins-2-plugins	eq	4.10.1650890594__1.el8
jenkins-2-plugins	eq	4.10.1647505461__1.el8
jenkins-2-plugins	eq	4.10.1675936179__1.el8
jenkins-2-plugins	eq	4.6.1609853716__1.el8
jenkins-2-plugins	eq	4.9.1642607680__1.el8
jenkins-2-plugins	eq	4.10.1680703106__1.el8
jenkins-2-plugins	eq	4.9.1669894222__1.el8