GitHub Advisoryadvisory · Maven

GHSA-6954-h5c8-m29f Jenkins Lucene-Search Plugin vulnerable to reflected (XSS) cross-site scripting

HIGH Published 2022-07-28 Modified 2024-01-03 Official page ↗
Aliases
CVE-2022-36922
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:lucene-search
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2022-08-11

Affected packages

• Maven org.jenkins-ci.plugins:lucene-search: < 387.v938a → fixed in 387.v938a

Description

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the search result page. This results in a reflected cross-site scripting (XSS) vulnerability.

Related

Alias · CVE (1)

  • CVE-2022-36922 Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References