GitHub Advisoryadvisory · Maven

GHSA-4m42-8qfq-h3q9 Cross-site Scripting in Jenkins Rundeck Plugin

HIGH Published 2022-05-18 Modified 2022-12-02 Official page ↗
Aliases
CVE-2022-30956
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:rundeck
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2022-06-02

Affected packages

• Maven org.jenkins-ci.plugins:rundeck: < 3.6.11 → fixed in 3.6.11

Description

Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads. Rundeck Plugin 3.6.11 sanitizes URLs submitted in Rundeck webhook payloads.

Related

Alias · CVE (1)

  • CVE-2022-30956 Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References