Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a…
jenkins·CWE-79·Published 2021-02-24
Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Jenkins Repository Connector Plugin 2.0.3 escapes parameter names and descriptions when creating new parameters.
Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Jenkins Repository Connector Plugin 2.0.3 escapes parameter names and descriptions when creating new parameters.
Jenkins Repository Connector Plugin versiones 2.0.2 y anteriores, no escapan los parámetros names y descriptions de compilaciones anteriores, resultando en una vulnerabilidad de tipo cross-site scripting (XSS) almacenado explotable por atacantes con permiso Item/Configure
| Version | Type | Source | Base | Exp | Impact | Vector |
|---|---|---|---|---|---|---|
| 2.0 | Primary | NVD | 3.5 | 6.8 | 2.9 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
| 3.1 | Primary | NVD | 5.4 | 2.3 | 2.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| 3.1 | Secondary | GHSA | 5.4 | — | — | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |