CVE-2022-30970

CWE-79 — Cross-site Scripting (XSS)5 documents5 sources
Severity
5.4MEDIUM
EPSS
16.8%
top 5.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Project Jenkins Autocomplete Parameter PluginJenkins Autocomplete Parameter
Timeline
PublishedMay 17
Latest updateMay 18

Description

Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

🔴Vulnerability Details

3
GHSA
Cross-site Scripting in Jenkins Autocomplete Parameter Plugin↗2022-05-18
▶
OSV
Cross-site Scripting in Jenkins Autocomplete Parameter Plugin↗2022-05-18
▶
CVEList
CVE-2022-30970: Jenkins Autocomplete Parameter Plugin 1↗2022-05-17
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2022-05-17↗2022-05-17
▶