CVE-2022-30965 — Cross-site Scripting in Project Jenkins Promoted Builds Plugin

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
5.4MEDIUMNVD
EPSS
16.8%
top 5.04%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Promoted Builds PluginJenkins Promoted Builds
Timeline
PublishedMay 17
Latest updateMay 18

Description

Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5jenkins_project/jenkins_promoted_builds_pluginunspecified — 1.9

🔴Vulnerability Details

3
OSV
Stored Cross-site Scripting vulnerabilities in Jenkins promoted Builds (Simple) plugin providing additional parameter types↗2022-05-18
▶
GHSA
Stored Cross-site Scripting vulnerabilities in Jenkins promoted Builds (Simple) plugin providing additional parameter types↗2022-05-18
▶
CVEList
CVE-2022-30965: Jenkins Promoted Builds (Simple) Plugin 1↗2022-05-17
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2022-05-17↗2022-05-17
▶
CVE-2022-30965 — Cross-site Scripting | cvebase