CVE-2022-36905

Опубликовано: 27 июл. 2022

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Ссылки

http://www.openwall.com/lists/oss-security/2022/07/27/1
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2686
Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/07/27/1
Mailing List
Third Party Advisory
https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2686
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:maven_metadata:*:*:*:*:*:jenkins_ci:*:*

Версия до 2.2 (включая)

EPSS

Процентиль: 69%

0.00596

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-8294-mv9c-7m5h

CVSS3: 8

github

больше 3 лет назад

Stored XSS vulnerability in Jenkins Maven Metadata Plugin for Jenkins CI server plugin

BDU:2022-04872