Stored Cross-Site Scripting Vulnerability in Jenkins Shelve Project Plugin
Moderate severity
GitHub Reviewed
Published
May 14, 2022
to the GitHub Advisory Database
•
Updated Jan 30, 2024
Package
Affected versions
<= 1.5
Patched versions
2.0
Description
Published by the National Vulnerability Database
Aug 1, 2018
Published to the GitHub Advisory Database
May 14, 2022
Reviewed
Jan 30, 2024
Last updated
Jan 30, 2024
A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjectsAction/index.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.
References