CVE-2022-25185

CWE-79 — Cross-site Scripting (XSS)5 documents5 sources
Severity
5.4MEDIUM
EPSS
0.2%
top 57.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Generic Webhook Trigger PluginJenkins Generic Webhook Trigger
Timeline
PublishedFeb 15
Latest updateFeb 16

Description

Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

Patches

Patch: www.jenkins.io ↗Patch: www.jenkins.io ↗

🔴Vulnerability Details

3
GHSA
Stored XSS vulnerability in Jenkins Generic Webhook Trigger Plugin↗2022-02-16
▶
OSV
Stored XSS vulnerability in Jenkins Generic Webhook Trigger Plugin↗2022-02-16
▶
CVEList
CVE-2022-25185: Jenkins Generic Webhook Trigger Plugin 1↗2022-02-15
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2022-02-15↗2022-02-15
▶