GitHub Advisoryadvisory · Maven

GHSA-8294-mv9c-7m5h Stored XSS vulnerability in Jenkins Maven Metadata Plugin for Jenkins CI server plugin

HIGH Published 2022-07-28 Modified 2022-12-12 Official page ↗
Aliases
CVE-2022-36905
Ecosystem
Maven
Packages
eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2022-12-12

Affected packages

• Maven eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin: <= 2.2 (no fix yet)

Description

Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Related

Alias · CVE (1)

  • CVE-2022-36905 Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References