Description

Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability.

Remediation

References

http://www.openwall.com/lists/oss-security/2020/09/01/3

https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1905

Related Vulnerabilities

CVE-2023-37948 Vulnerability in maven package org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute

CVE-2021-21166 Vulnerability in npm package electron

CVE-2020-7733 Vulnerability in maven package org.webjars.bowergithub.faisalman:ua-parser-js

CVE-2023-37961 Vulnerability in maven package org.jenkins-ci.plugins:assembla-auth

CVE-2023-44483 Vulnerability in maven package org.apache.santuario:xmlsec

Severity

High

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory