CVE-2022-29041 — Cross-site Scripting in Jenkins Jira

CWE-79 — Cross-site Scripting6 documents6 sources
Severity
5.4MEDIUMNVD
EPSS
8.1%
top 7.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins JiraJenkins Project Jenkins Jira Plugin
Timeline
PublishedApr 12
Latest updateApr 13

Description

Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5jenkins_project/jenkins_jira_pluginunspecified — 3.7
▶NVDjenkins/jira< 3.6.1+1

🔴Vulnerability Details

3
GHSA
Stored Cross-site Scripting vulnerability in Jenkins Jira Plugin↗2022-04-13
▶
OSV
Stored Cross-site Scripting vulnerability in Jenkins Jira Plugin↗2022-04-13
▶
CVEList
CVE-2022-29041: Jenkins Jira Plugin 3↗2022-04-12
▶

📋Vendor Advisories

2
Jenkins
Jenkins Security Advisory 2022-04-12↗2022-04-12
▶
Red Hat
Jira: Stored XSS vulnerabilities in Jenkins Jira plugin↗2022-04-12
▶
CVE-2022-29041 — Cross-site Scripting in Jenkins Jira | cvebase