GHSA-28w4-h56g-grg7

Suggest an improvement
Source
https://github.com/advisories/GHSA-28w4-h56g-grg7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-28w4-h56g-grg7/GHSA-28w4-h56g-grg7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-28w4-h56g-grg7
Aliases
  • CVE-2022-38664
Published
2022-08-24T00:00:28Z
Modified
2024-02-16T08:16:28.848621Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Cross-site Scripting in Jenkins Job Configuration History Plugin
Details

Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-28T22:08:00Z",
    "nvd_published_at": "2022-08-23T17:15:00Z",
    "severity": "MODERATE"
}
References

Affected packages

Maven / org.jenkins-ci.plugins:jobConfigHistory

Package

Name
org.jenkins-ci.plugins:jobConfigHistory
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/jobConfigHistory

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1166.vc9f255f45b

Affected versions

1.*
1.10
1.11
1.12
1.13
2.*
2.0
2.1
2.1.1
2.2
2.3
2.4
2.5
2.6
2.8
2.9
2.10
2.11
2.12
2.13
2.14
2.15
2.16
2.17
2.18
2.18.1
2.18.2
2.18.3
2.19
2.20
2.21
2.22
2.23
2.23.1
2.24
2.25
2.26
2.27
2.28
2.28.1
2.29-rc1073.41ef89cf4e15
2.29
2.30
2.31-rc1092.de9e11acbcf3
2.31-rc1098.b666422863b2
2.31-rc1107.2354f08725a_8
2.31-rc1118.fdcd7d8898ff
1119.*
1119.v509e1017356b_
1133.*
1133.v0f5420f85053
1139.*
1139.v888b_656ca_f6d
1146.*
1146.v94c2521f9213
1148.*
1148.v8607da_ef251e
1155.*
1155.v28a_46a_cc06a_5
1156.*
1156.v536a_97b_8d649
1163.*
1163.ve82c7c6e60a_3
1165.*
1165.v8cc9fd1f4597

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-28w4-h56g-grg7/GHSA-28w4-h56g-grg7.json"
last_known_affected_version_range 
"<= 1165.v8cc9fd1f4597"