GHSA-wx66-pm7r-2q82

Source

https://github.com/advisories/GHSA-wx66-pm7r-2q82

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-wx66-pm7r-2q82/GHSA-wx66-pm7r-2q82.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wx66-pm7r-2q82

Aliases

CVE-2021-21630

Published

2022-05-24T17:45:44Z

Modified

2024-02-16T08:15:11.157853Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Stored XSS vulnerability in Jenkins Extra Columns Plugin

Details

Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Additionally, a view containing such a job needs to be configured with the build parameters column, or the attacker also needs View/Configure permission.

Jenkins Extra Columns Plugin 1.23 escapes parameter values in the build parameters column.

Database specific

{
    "nvd_published_at": "2021-03-30T12:16:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-15T17:27:58Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:extra-columns

Package

Name: org.jenkins-ci.plugins:extra-columns; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/extra-columns

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.23

Affected versions

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

1.10

1.11

1.12

1.13

1.14

1.15

1.16

1.17

1.18

1.19

1.20

1.21

1.22

Database specific

{
    "last_known_affected_version_range": "<= 1.22"
}