Description
Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
Remediation
References
https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1771
http://www.openwall.com/lists/oss-security/2020/07/02/7
Related Vulnerabilities
CVE-2022-21671 Vulnerability in npm package @replit/crosis
CVE-2023-40989 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-common
CVE-2019-3875 Vulnerability in maven package org.keycloak:keycloak-services
CVE-2023-22832 Vulnerability in maven package org.apache.nifi:nifi-ccda-processors
CVE-2020-2243 Vulnerability in maven package org.jenkins-ci.plugins:vmanager-plugin