Reflected XSS vulnerability in Jenkins VncRecorder Plugin

2022-05-2417:22:19

Google

osv.dev

0.001 Low

EPSS

Percentile

36.1%

JSON

VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the checkVncServ form validation endpoint output.

This results in a reflected cross-site scripting (XSS) vulnerability.

VncRecorder Plugin 1.35 escapes the parameter value in the output.

CPENameOperatorVersion
org.jenkins-ci.plugins:vncrecordereq1.1
org.jenkins-ci.plugins:vncrecordereq1.22
org.jenkins-ci.plugins:vncrecordereq1.15
org.jenkins-ci.plugins:vncrecordereq1.13
org.jenkins-ci.plugins:vncrecordereq1.23
org.jenkins-ci.plugins:vncrecordereq1.14
org.jenkins-ci.plugins:vncrecordereq1.24
org.jenkins-ci.plugins:vncrecordereq1.21
org.jenkins-ci.plugins:vncrecordereq1.12
org.jenkins-ci.plugins:vncrecordereq1.19

Name	Operator	Version
org.jenkins-ci.plugins:vncrecorder	eq	1.1
org.jenkins-ci.plugins:vncrecorder	eq	1.22
org.jenkins-ci.plugins:vncrecorder	eq	1.15
org.jenkins-ci.plugins:vncrecorder	eq	1.13
org.jenkins-ci.plugins:vncrecorder	eq	1.23
org.jenkins-ci.plugins:vncrecorder	eq	1.14
org.jenkins-ci.plugins:vncrecorder	eq	1.24
org.jenkins-ci.plugins:vncrecorder	eq	1.21
org.jenkins-ci.plugins:vncrecorder	eq	1.12
org.jenkins-ci.plugins:vncrecorder	eq	1.19