Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1ocW1wLXZ4ajctNXdwcc4AAtEY

Cross-site Scripting in Jenkins Validating Email Parameter Plugin

Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type.

Additionally, it disables the security hardening added in Jenkins 2.44 and LTS 2.32.2 as part of the SECURITY-353 / CVE-2017-2601 fix that protects the "Build With Parameters" and "Parameters" pages from vulnerabilities like this by default.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Permalink: https://github.com/advisories/GHSA-hqmp-vxj7-5wpq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ocW1wLXZ4ajctNXdwcc4AAtEY
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: over 1 year ago

CVSS Score: 8.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Identifiers: GHSA-hqmp-vxj7-5wpq, CVE-2022-34791
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-34791
• https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2165
• https://github.com/advisories/GHSA-hqmp-vxj7-5wpq

Blast Radius: 1.0

Affected Packages