Description

Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Remediation

References

http://www.openwall.com/lists/oss-security/2022/07/27/1

https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2686

Related Vulnerabilities

CVE-2020-28452 Vulnerability in maven package com.softwaremill.akka-http-session:core_2.13

CVE-2020-11976 Vulnerability in maven package org.apache.wicket:wicket-core

CVE-2019-19899 Vulnerability in maven package io.pebbletemplates:pebble

CVE-2020-9498 Vulnerability in maven package org.apache.guacamole:guacamole

CVE-2021-23448 Vulnerability in npm package config-handler

Severity

Medium

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory