Reflected Cross site scripting in Jenkins Embeddable Build Status Plugin

2022-06-2400:00:31

Google

osv.dev

0.001 Low

EPSS

Percentile

31.3%

JSON

Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a ‘link’ query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting (XSS) vulnerability.

Embeddable Build Status Plugin 2.0.4 limits URLs to http and https protocols and correctly escapes the provided value.

CPENameOperatorVersion
org.jenkins-ci.plugins:embeddable-build-statuseq1.0
org.jenkins-ci.plugins:embeddable-build-statuseq1.5
org.jenkins-ci.plugins:embeddable-build-statuseq2.0
org.jenkins-ci.plugins:embeddable-build-statuseq2.0.2
org.jenkins-ci.plugins:embeddable-build-statuseq1.9
org.jenkins-ci.plugins:embeddable-build-statuseq1.3
org.jenkins-ci.plugins:embeddable-build-statuseq1.4
org.jenkins-ci.plugins:embeddable-build-statuseq1.2
org.jenkins-ci.plugins:embeddable-build-statuseq1.7
org.jenkins-ci.plugins:embeddable-build-statuseq1.1

Name	Operator	Version
org.jenkins-ci.plugins:embeddable-build-status	eq	1.0
org.jenkins-ci.plugins:embeddable-build-status	eq	1.5
org.jenkins-ci.plugins:embeddable-build-status	eq	2.0
org.jenkins-ci.plugins:embeddable-build-status	eq	2.0.2
org.jenkins-ci.plugins:embeddable-build-status	eq	1.9
org.jenkins-ci.plugins:embeddable-build-status	eq	1.3
org.jenkins-ci.plugins:embeddable-build-status	eq	1.4
org.jenkins-ci.plugins:embeddable-build-status	eq	1.2
org.jenkins-ci.plugins:embeddable-build-status	eq	1.7
org.jenkins-ci.plugins:embeddable-build-status	eq	1.1