Jenkins Build Pipeline Plugin vulnerable to Cross-site Scripting
Moderate severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Mar 11, 2023
Package
Affected versions
<= 1.5.8
Patched versions
None
Description
Published by the National Vulnerability Database
Aug 7, 2019
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Mar 3, 2023
Last updated
Mar 11, 2023
Build Pipeline Plugin does not properly escape variables in views, resulting in a stored cross-site scripting vulnerability exploitable by users with permission to configure build pipelines.
This vulnerability is only exploitable on Jenkins releases older than 2.146 or 2.138.2 due to the security hardening implemented in those releases.
As of publication of this advisory, there is no fix.
References