GitHub Advisoryadvisory · Maven

GHSA-g364-c7w5-93wh Jenkins Delivery Pipeline Plugin Cross-site Scripting vulnerability

MEDIUM Published 2022-05-14 Modified 2022-12-12 Official page ↗
Aliases
CVE-2017-1000404
Ecosystem
Maven
Packages
se.diabol.jenkins.pipeline:delivery-pipeline-plugin
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-12-12

Affected packages

• Maven se.diabol.jenkins.pipeline:delivery-pipeline-plugin: < 1.0.8 → fixed in 1.0.8

Description

The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScript, resulting in a cross-site scripting vulnerability through specially crafted URLs. Version 1.0.8 of the plugin converts the value to a boolean (true/false) and inserts that into the page instead.

Related

Alias · CVE (1)

  • CVE-2017-1000404 The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References