Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads. Rundeck Plugin 3.6.11 sanitizes URLs submitted in Rundeck webhook payloads.
{ "nvd_published_at": "2022-05-17T15:15:00Z", "github_reviewed_at": "2022-06-02T14:54:12Z", "severity": "HIGH", "github_reviewed": true, "cwe_ids": [ "CWE-79" ] }