GitHub Advisoryadvisory · Maven

GHSA-5vjc-qx43-r747 Stored Cross-site Scripting in folder-auth plugin

MEDIUM Published 2022-03-18 Modified 2026-02-03 Official page ↗
Aliases
CVE-2022-27200
Ecosystem
Maven
Packages
io.jenkins.plugins:folder-auth
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2022-03-18

Affected packages

• Maven io.jenkins.plugins:folder-auth: < 1.4 → fixed in 1.4

Description

Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission. Folder-based Authorization Strategy Plugin 1.4 escapes the names of roles shown on the configuration form. See https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2646

Related

Alias · CVE (1)

  • CVE-2022-27200 Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form,… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References