GitHub Advisoryadvisory · Maven

GHSA-39r8-4962-j7vg Stored XSS vulnerability in Jenkins Maven Repository Server Plugin

MEDIUM Published 2023-06-14 Modified 2024-01-30 Official page ↗
Aliases
CVE-2023-35144
Ecosystem
Maven
Packages
jenkins:repository
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-01-30

Affected packages

• Maven jenkins:repository: <= 1.10 (no fix yet)

Description

Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape project and build display names on the Build Artifacts As Maven Repository page, resulting in a stored cross-site scripting (XSS) vulnerability.

Related

Alias · CVE (1)

  • CVE-2023-35144 Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape project and build display names on the Build Artifacts As Maven… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References