GitHub Advisoryadvisory · Maven

GHSA-mv77-fj63-q5w8 Stored XSS vulnerability in Jenkins GitHub Plugin

HIGH Published 2023-10-25 Modified 2023-11-02 Official page ↗
Aliases
CVE-2023-46650
Ecosystem
Maven
Packages
com.coravy.hudson.plugins.github:github
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2023-10-30

Affected packages

• Maven com.coravy.hudson.plugins.github:github: < 1.37.3.1 → fixed in 1.37.3.1

Description

Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. GitHub Plugin 1.37.3.1 escapes GitHub project URL on the build page when showing changes.

Related

Alias · CVE (1)

  • CVE-2023-46650 Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References