GHSA-f9gf-2q87-5m44

Source

https://github.com/advisories/GHSA-f9gf-2q87-5m44

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-f9gf-2q87-5m44/GHSA-f9gf-2q87-5m44.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f9gf-2q87-5m44

Aliases

CVE-2021-21700

Published

2022-05-24T19:20:33Z

Modified

2024-02-16T08:19:29.158340Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Stored XSS vulnerability in Jenkins Scriptler Plugin

Details

Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Scriptler scripts.

Jenkins Scriptler Plugin 3.4 escapes the name of scripts on the UI when asking to confirm their deletion.

Database specific

{
    "nvd_published_at": "2021-11-12T11:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-15T16:51:12Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:scriptler

Package

Name: org.jenkins-ci.plugins:scriptler; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/scriptler

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.4

Affected versions

2.*

2.0

2.1

2.2

2.2.1

2.3

2.4

2.4.1

2.5

2.5.1

2.6

2.6.1

2.7

2.9

3.*

3.0-alpha

3.1

3.2

3.3

Database specific

{
    "last_known_affected_version_range": "<= 3.3"
}