QwikSec

Security Database

CVE

CWE

Training

CVE-2022-36905

Published: Jul 27, 2022

Modified: Aug 3, 2024

PUBLISHED

Description

Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Vendor	Product	Versions
Jenkins project	Jenkins Maven Metadata Plugin for Jenkins CI server Plugin	affected `unspecified - <= 2.2` unknown `next of 2.2 - < unspecified`

References

https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2686

x_refsource_CONFIRM

[oss-security] 20220727 Multiple vulnerabilities in Jenkins plugins

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.