CVE-2022-30961

CWE-79 — Cross-site Scripting (XSS)5 documents5 sources
Severity
5.4MEDIUM
EPSS
16.8%
top 5.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Autocomplete Parameter PluginJenkins Autocomplete Parameter
Timeline
PublishedMay 17
Latest updateMay 18

Description

Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

🔴Vulnerability Details

3
OSV
Cross-site Scripting in Jenkins Autocomplete Parameter Plugin↗2022-05-18
▶
GHSA
Cross-site Scripting in Jenkins Autocomplete Parameter Plugin↗2022-05-18
▶
CVEList
CVE-2022-30961: Jenkins Autocomplete Parameter Plugin 1↗2022-05-17
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2022-05-17↗2022-05-17
▶