Cross-site Scripting in Jenkins Rundeck Plugin

2022-05-1800:00:40

Google

osv.dev

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads. Rundeck Plugin 3.6.11 sanitizes URLs submitted in Rundeck webhook payloads.

CPENameOperatorVersion
org.jenkins-ci.plugins:rundeckeq2.11
org.jenkins-ci.plugins:rundeckeq2.1
org.jenkins-ci.plugins:rundeckeq1.6
org.jenkins-ci.plugins:rundeckeq3.4
org.jenkins-ci.plugins:rundeckeq3.6.6
org.jenkins-ci.plugins:rundeckeq1.8
org.jenkins-ci.plugins:rundeckeq3.6.1
org.jenkins-ci.plugins:rundeckeq1.5
org.jenkins-ci.plugins:rundeckeq3.6.2
org.jenkins-ci.plugins:rundeckeq3.6.7

Name	Operator	Version
org.jenkins-ci.plugins:rundeck	eq	2.11
org.jenkins-ci.plugins:rundeck	eq	2.1
org.jenkins-ci.plugins:rundeck	eq	1.6
org.jenkins-ci.plugins:rundeck	eq	3.4
org.jenkins-ci.plugins:rundeck	eq	3.6.6
org.jenkins-ci.plugins:rundeck	eq	1.8
org.jenkins-ci.plugins:rundeck	eq	3.6.1
org.jenkins-ci.plugins:rundeck	eq	1.5
org.jenkins-ci.plugins:rundeck	eq	3.6.2
org.jenkins-ci.plugins:rundeck	eq	3.6.7