GHSA-gc87-qwmv-7x9x

Source

https://github.com/advisories/GHSA-gc87-qwmv-7x9x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-gc87-qwmv-7x9x/GHSA-gc87-qwmv-7x9x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-gc87-qwmv-7x9x

Aliases

CVE-2021-21622

Published

2022-05-24T17:43:01Z

Modified

2024-02-16T08:14:36Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Stored XSS vulnerability in Jenkins Artifact Repository Parameter Plugin

Details

Jenkins Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape parameter names and descriptions.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Jenkins Artifact Repository Parameter Plugin 1.0.1 escapes parameter names and descriptions.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-12-13T18:59:01Z",
    "nvd_published_at":  "2021-02-24T16:15:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / io.jenkins.plugins:artifact-repository-parameter

Package

Name: io.jenkins.plugins:artifact-repository-parameter; View open source insights on deps.dev
Purl: pkg:maven/io.jenkins.plugins/artifact-repository-parameter

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.0.1

Affected versions

1.*

1.0.0

Database specific

last_known_affected_version_range

"<= 1.0.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-gc87-qwmv-7x9x/GHSA-gc87-qwmv-7x9x.json"