GHSA-28w4-h56g-grg7

Cross-site Scripting in Jenkins Job Configuration History Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-38664

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:jobConfigHistory	< 1166.vc9f255f45b	1166.vc9f255f45b

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-38664 advisory
https://github.com/jenkinsci/job-config-history-plugin/commit/c9f255f45b8a6ed008d66be094526adfd80ca035 web
https://github.com/jenkinsci/job-config-history-plugin package
https://www.jenkins.io/security/advisory/2022-08-23/#SECURITY-2765 web
http://www.openwall.com/lists/oss-security/2022/08/23/2 web