GHSA-vqwg-4v6f-h6x5

Suggest an improvement
Source
https://github.com/advisories/GHSA-vqwg-4v6f-h6x5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-vqwg-4v6f-h6x5/GHSA-vqwg-4v6f-h6x5.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-vqwg-4v6f-h6x5
Aliases
Published
2022-01-13T00:01:04Z
Modified
2024-01-02T05:50:13.958889Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Stored XSS vulnerability in Matrix Project Plugin
Details

Jenkins Matrix Project Plugin prior to 1.20 and 1.18.1 does not escape HTML metacharacters in node and label names, and label descriptions.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

Matrix Project Plugin 1.20 and 1.18.1 escapes HTML metacharacters in node and label names, and label descriptions.

Database specific
{
    "nvd_published_at": "2022-01-12T20:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-29T04:33:51Z"
}
References

Affected packages

Maven / org.jenkins-ci.plugins:matrix-project

Package

Name
org.jenkins-ci.plugins:matrix-project
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/matrix-project

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.19
Fixed
1.20

Affected versions

1.*

1.19

Maven / org.jenkins-ci.plugins:matrix-project

Package

Name
org.jenkins-ci.plugins:matrix-project
View open source insights on deps.dev
Purl
pkg:maven/org.jenkins-ci.plugins/matrix-project

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.18.1

Affected versions

1.*

1.0-beta-1
1.0
1.1
1.2
1.2.1
1.3
1.4
1.4.1
1.5
1.6
1.7
1.7.1
1.8
1.9
1.10
1.11
1.12
1.13
1.14
1.14.1
1.15
1.16
1.17
1.18