~ / search / GHSA-2jgw-28qh-6mg8

GHSA-2jgw-28qh-6mg8

Jenkins Quay.io trigger Plugin Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-30520

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:quayio-trigger <= 0.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads.

References

External links from the advisory. They lead to third-party sites.