Stored Cross-site Scripting vulnerability in Jenkins List Git Branches Parameter Plugin

2022-03-1600:00:43

Google

osv.dev

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the ‘List Git branches (and more)’ parameter, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CPENameOperatorVersion
org.jenkins-ci.plugins:list-git-branches-parametereq0.0.1
org.jenkins-ci.plugins:list-git-branches-parametereq0.0.7
org.jenkins-ci.plugins:list-git-branches-parametereq0.0.9
org.jenkins-ci.plugins:list-git-branches-parametereq0.0.4
org.jenkins-ci.plugins:list-git-branches-parametereq0.0.8
org.jenkins-ci.plugins:list-git-branches-parametereq0.0.3

Name	Operator	Version
org.jenkins-ci.plugins:list-git-branches-parameter	eq	0.0.1
org.jenkins-ci.plugins:list-git-branches-parameter	eq	0.0.7
org.jenkins-ci.plugins:list-git-branches-parameter	eq	0.0.9
org.jenkins-ci.plugins:list-git-branches-parameter	eq	0.0.4
org.jenkins-ci.plugins:list-git-branches-parameter	eq	0.0.8
org.jenkins-ci.plugins:list-git-branches-parameter	eq	0.0.3