Stored XSS vulnerability in Pipeline Maven Integration Plugin via unescaped display name
High severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Dec 20, 2023
Package
Affected versions
<= 3.9.2
Patched versions
3.9.3
Description
Published by the National Vulnerability Database
Sep 16, 2020
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Dec 29, 2022
Last updated
Dec 20, 2023
Credits
-
NotMyFault Analyst
Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job’s display name shown as part of a build cause.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Pipeline Maven Integration Plugin 3.9.3 escapes upstream job names in build causes.
References