Cross-site Scripting in Jenkins Deployment Dashboard Plugin
High severity
GitHub Reviewed
Published
Jul 1, 2022
to the GitHub Advisory Database
•
Updated Jan 9, 2024
Package
Affected versions
<= 1.0.10
Patched versions
None
Description
Published by the National Vulnerability Database
Jun 30, 2022
Published to the GitHub Advisory Database
Jul 1, 2022
Reviewed
Jul 12, 2022
Last updated
Jan 9, 2024
Credits
-
NotMyFault Analyst
Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
As of publication of this advisory, there is no fix.
References