GitHub Advisoryadvisory · Maven

GHSA-w43x-5f8f-686p Stored XSS vulnerability in multiple axis builds tooltips in Jenkins Matrix Project Plugin

HIGH Published 2022-05-24 Modified 2022-12-27 Official page ↗
Aliases
CVE-2020-2225
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:matrix-project
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2022-06-24

Affected packages

• Maven org.jenkins-ci.plugins:matrix-project: < 1.17 → fixed in 1.17

Description

Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission. Matrix Project Plugin 1.17 escapes the axis names shown in these tooltips.

Related

Alias · CVE (1)

  • CVE-2020-2225 Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References