CVE-2022-27207

2022-03-1517:15:11

Google

osv.dev

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the ‘Global Build Stats’ page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

CPENameOperatorVersion
global-build-stats-plugineqglobal-build-stats-1.1
global-build-stats-plugineqglobal-build-stats-1.5
global-build-stats-plugineqglobal-build-stats-1.4
global-build-stats-plugineqglobal-build-stats-1.3
global-build-stats-plugineqglobal-build-stats-1.2

Name	Operator	Version
global-build-stats-plugin	eq	global-build-stats-1.1
global-build-stats-plugin	eq	global-build-stats-1.5
global-build-stats-plugin	eq	global-build-stats-1.4
global-build-stats-plugin	eq	global-build-stats-1.3
global-build-stats-plugin	eq	global-build-stats-1.2