CVE-2022-25185
published 2022-02-15CVE-2022-25185: Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting…
medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | agent_server_parameter_plugin | — | — |
| jenkins | build_step_plugin | — | — |
| jenkins | checkmarx_plugin | — | — |
| jenkins | chef_sinatra_plugin | — | — |
| jenkins | conjur_secrets_plugin | — | — |
| jenkins | convertigo_mobile_platform_plugin | — | — |
| jenkins | custom_checkbox_parameter_plugin | — | — |
| jenkins | deprecated_groovy_libraries_plugin | — | — |
| jenkins | doktor_plugin | — | — |
| jenkins | fortify_plugin | — | — |
| jenkins | generic_webhook_trigger | <= 1.81 | — |
| jenkins | generic_webhook_trigger_plugin | — | — |
| jenkins | gitlab_authentication_plugin | — | — |
| jenkins | groovy_plugin | — | — |
| jenkins | hashicorp_vault_plugin | — | — |
| jenkins | multibranch_plugin | — | — |
| jenkins | scp_publisher_plugin | — | — |
| jenkins | snow_commander_plugin | — | — |
| jenkins | support_core_plugin | — | — |
| jenkins | swamp_plugin | — | — |
| jenkins | team_views_plugin | — | — |
| jenkins_project | jenkins_generic_webhook_trigger_plugin | unspecified – 1.81 | — |