jenkinsci/promoted-builds-simple-plugin · Security
Stored Cross-site Scripting vulnerability in Jenkins Promoted Builds (Simple) Plugin
- GHSA ID
- GHSA-gc7q-7vg3-h8gf
- CVE ID
- CVE-2022-25202
- Severity
- medium
- Published
- Updated
- CVSS
- 6.8 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- CVSS v3
- 6.8 · CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Description
Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name of custom promotion levels, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')