Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact versions parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
References
Link | Resource |
---|---|
https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2784 | Vendor Advisory |
Configurations
History
03 Nov 2023, 14:14
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-79 |
25 Oct 2023, 18:17
Type | Values Removed | Values Added |
---|---|---|
CWE |
29 Jun 2022, 18:36
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 3.5
v3 : 5.4 |
First Time |
Jenkins
Jenkins maven Metadata |
|
CPE | cpe:2.3:a:jenkins:maven_metadata:*:*:*:*:*:jenkins:*:* | |
References | (CONFIRM) https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2784 - Vendor Advisory |
23 Jun 2022, 17:19
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-06-23 17:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-34190
Mitre link : CVE-2022-34190
CVE.ORG link : CVE-2022-34190
JSON object : View
Products Affected
jenkins
- maven_metadata
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')