GHSA-hv53-qjg6-5pm9

Source

https://github.com/advisories/GHSA-hv53-qjg6-5pm9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-hv53-qjg6-5pm9/GHSA-hv53-qjg6-5pm9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hv53-qjg6-5pm9

Aliases

CVE-2020-2173

Published

2022-05-24T17:13:39Z

Modified

2023-11-08T04:02:54.773Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

XSS vulnerability in Jenkins Gatling Plugin

Details

Gatling Plugin 1.2.7 and earlier serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641 and 1.625.3. This results in a cross-site scripting (XSS) vulnerability exploitable by users able to change report content.

Gatling Plugin 1.3.0 no longer allows viewing Gatling reports directly in Jenkins. Instead users need to download an archive containing the report.

Database specific

{
    "nvd_published_at": "2020-04-07T13:15:00Z",
    "github_reviewed_at": "2022-12-20T17:39:30Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Maven / org.jenkins-ci.plugins:gatling

Package

Name: org.jenkins-ci.plugins:gatling; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/gatling

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.0

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.1.0

1.1.1

1.1.2

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

Database specific

{
    "last_known_affected_version_range": "<= 1.2.7"
}