GHSA-qqwx-hcp6-25vr

Source

https://github.com/advisories/GHSA-qqwx-hcp6-25vr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-qqwx-hcp6-25vr/GHSA-qqwx-hcp6-25vr.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qqwx-hcp6-25vr

Aliases

CVE-2022-25185

Published

2022-02-16T00:01:29Z

Modified

2024-02-16T08:03:51.915813Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Stored XSS vulnerability in Jenkins Generic Webhook Trigger Plugin

Details

Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Database specific

{
    "nvd_published_at": "2022-02-15T17:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-01T23:38:24Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:generic-webhook-trigger

Package

Name: org.jenkins-ci.plugins:generic-webhook-trigger; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/generic-webhook-trigger

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.82

Affected versions

0.*

0.1.0

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

1.10

1.11

1.12

1.13

1.14

1.15

1.16

1.17

1.18

1.19

1.20

1.21

1.22

1.23

1.24

1.25

1.26

1.27

1.28

1.29

1.30

1.31

1.32

1.33

1.34

1.35

1.36

1.37

1.38

1.39

1.40

1.41

1.42

1.43

1.44

1.45

1.46

1.47

1.48

1.49

1.50

1.51

1.52

1.53

1.54

1.55

1.56

1.57

1.58

1.59

1.60

1.61

1.62

1.63

1.64

1.65

1.66

1.67

1.68

1.69

1.71

1.72

1.74

1.75

1.76

1.77

1.78

1.79

1.80

1.81