Vulnerability GHSA-qcj2-99cg-mppf

Medium Risk

1 year ago

Jenkins Git Parameter Plugin vulnerable to code injection due to inexhaustive parameter check

0.4.0 - 0.5.1 and 0.8.0 - 0.8.1 and 0.10.0 - 0.11.0

Summary

Jenkins Git Parameter Plugin vulnerable to code injection due to inexhaustive parameter check

Details

Jenkins Git Parameter Plugin implements a choice build parameter that lists the configured Git SCM’s branches, tags, pull requests, and revisions.

Git Parameter Plugin 439.vb_0e46ca_14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered choices.

This allows attackers with Item/Build permission to inject arbitrary values into Git parameters.

Git Parameter Plugin 444.vca_b_84d3703c2 validates that the Git parameter value submitted to the build matches one of the offered choices.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk

3 months ago

Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names

0.4.0 - 0.5.1 and 0.8.0 - 0.8.1 and 0.10.0 - 0.11.0 GHSA-hwvp-7xqv-8jx3

High Risk

4 years ago

Stored XSS vulnerability in Jenkins Git Parameter Plugin

0.4.0 - 0.5.1 and 0.8.0 - 0.8.1 GHSA-j7q2-c6r4-x2jw

Medium Risk

4 years ago

Jenkins Git Parameter Plugin vulnerable to stored cross-site scripting (XSS)

0.4.0 - 0.5.1 and 0.8.0 - 0.8.1 GHSA-fgxc-mxvw-55mv

Medium Risk

4 years ago

Jenkins Git Parameter Plugin vulnerable to Stored cross-site scripting (XSS)

0.4.0 - 0.5.1 and 0.8.0 - 0.8.1 GHSA-hw26-fw67-qxm9

Medium Risk

4 years ago

Stored XSS vulnerability in Jenkins Git Parameter Plugin

0.4.0 - 0.5.1 and 0.8.0 - 0.8.1 GHSA-fcr6-6cph-vmcm

View all vulnerabilities for these packages

Impacted packages

org.jenkins-ci.tools:git-parameter

Timeline

Published

1 year ago

Last Modified

10 months ago