Vulnerability GHSA-j7q2-c6r4-x2jw

High Risk

4 years ago

Stored XSS vulnerability in Jenkins Git Parameter Plugin

0.4.0 - 0.5.1 and 0.8.0 - 0.8.1

Summary

Stored XSS vulnerability in Jenkins Git Parameter Plugin

Details

Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Git Parameter Plugin 0.9.13 escapes the repository field on the 'Build with Parameters' page.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk

3 months ago

Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names

0.4.0 - 0.5.1 and 0.8.0 - 0.8.1 and 0.10.0 - 0.11.0 GHSA-hwvp-7xqv-8jx3

Medium Risk

1 year ago

Jenkins Git Parameter Plugin vulnerable to code injection due to inexhaustive parameter check

0.4.0 - 0.5.1 and 0.8.0 - 0.8.1 and 0.10.0 - 0.11.0 GHSA-qcj2-99cg-mppf

Medium Risk

4 years ago

Jenkins Git Parameter Plugin vulnerable to stored cross-site scripting (XSS)

0.4.0 - 0.5.1 and 0.8.0 - 0.8.1 GHSA-fgxc-mxvw-55mv

Medium Risk

4 years ago

Jenkins Git Parameter Plugin vulnerable to Stored cross-site scripting (XSS)

0.4.0 - 0.5.1 and 0.8.0 - 0.8.1 GHSA-hw26-fw67-qxm9

Medium Risk

4 years ago

Stored XSS vulnerability in Jenkins Git Parameter Plugin

0.4.0 - 0.5.1 and 0.8.0 - 0.8.1 GHSA-fcr6-6cph-vmcm

View all vulnerabilities for these packages

Impacted packages

org.jenkins-ci.tools:git-parameter

Timeline

Published

4 years ago

Last Modified

2 years ago