Stored Cross-site Scripting vulnerability in Jenkins global-build-stats Plugin

2022-03-1600:00:43

Google

osv.dev

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the ‘Global Build Stats’ page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

CPENameOperatorVersion
org.jenkins-ci.plugins:global-build-statseq1.2
org.jenkins-ci.plugins:global-build-statseq1.5
org.jenkins-ci.plugins:global-build-statseq1.4
org.jenkins-ci.plugins:global-build-statseq1.1
org.jenkins-ci.plugins:global-build-statseq1.3

Name	Operator	Version
org.jenkins-ci.plugins:global-build-stats	eq	1.2
org.jenkins-ci.plugins:global-build-stats	eq	1.5
org.jenkins-ci.plugins:global-build-stats	eq	1.4
org.jenkins-ci.plugins:global-build-stats	eq	1.1
org.jenkins-ci.plugins:global-build-stats	eq	1.3