GHSA-35h9-h439-vvmr

Source

https://github.com/advisories/GHSA-35h9-h439-vvmr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-35h9-h439-vvmr/GHSA-35h9-h439-vvmr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-35h9-h439-vvmr

Aliases

CVE-2022-27213

Published

2022-03-16T00:00:42Z

Modified

2023-11-08T04:08:57.620689Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Stored Cross-site Scripting vulnerability in Jenkins Environment Dashboard Plugin

Details

Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.

Database specific

{
    "nvd_published_at": "2022-03-15T17:15:00Z",
    "github_reviewed_at": "2022-11-30T19:39:50Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Maven / io.jenkins.plugins:environment-dashboard

Package

Name: io.jenkins.plugins:environment-dashboard; View open source insights on deps.dev
Purl: pkg:maven/io.jenkins.plugins/environment-dashboard

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.1.10

Affected versions

1.*

1.1.10