GHSA-jwhm-9cjm-4493

Suggest an improvement
Source
https://github.com/advisories/GHSA-jwhm-9cjm-4493
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-jwhm-9cjm-4493/GHSA-jwhm-9cjm-4493.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-jwhm-9cjm-4493
Aliases
Published
2021-06-16T17:24:41Z
Modified
2024-01-02T05:44:52.377764Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Cross-site Scripting in Jenkins Dashboard View Plugin
Details

Jenkins Dashboard View Plugin prior to 2.16 and 2.12.1 does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.

As part of this fix, the property for image URLs was changed from url to imageUrl. Existing Configuration as Code configurations are still supported, but exports will emit the new property.

Database specific
{
    "nvd_published_at": "2021-05-11T15:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-19T19:16:07Z"
}
References

Affected packages

Maven / org.jenkins-ci.plugins:dashboard-view

Package

Name
org.jenkins-ci.plugins:dashboard-view
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/dashboard-view

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.13
Fixed
2.16

Affected versions

2.*

2.13
2.14
2.15

Maven / org.jenkins-ci.plugins:dashboard-view

Package

Name
org.jenkins-ci.plugins:dashboard-view
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/dashboard-view

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.12.1

Affected versions

2.*

2.0
2.0.1
2.0.2
2.1
2.2
2.3
2.4
2.5
2.6
2.7
2.8
2.9
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7
2.9.9
2.9.10
2.9.11
2.9.12
2.10
2.11
2.12