Cross-site Scripting in Jenkins Credentials Plugin
Moderate severity
GitHub Reviewed
Published
Apr 13, 2022
to the GitHub Advisory Database
•
Updated Jan 27, 2023
Package
Affected versions
<= 2.6.1
>= 2.6.2, <= 1074.v60e6c29b
= 1087.v16065d268466
>= 1105, <= 1111.v35a
Patched versions
2.6.1.1
1074.1076.v39c30cecb_0e2
1087.1089.v2f1b_9a_b_040e4
Description
Published by the National Vulnerability Database
Apr 12, 2022
Published to the GitHub Advisory Database
Apr 13, 2022
Reviewed
Apr 22, 2022
Last updated
Jan 27, 2023
Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
References