GHSA-2pc2-h97h-2mmw

Jenkins iceScrum Plugin vulnerable to stored Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-28160

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:icescrum	<= 1.1.6	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins iceScrum Plugin 1.1.6 and earlier does not sanitize iceScrum project URLs on build views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-28160 advisory
https://github.com/jenkinsci/icescrum-plugin package
https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3248 web
http://www.openwall.com/lists/oss-security/2024/03/06/3 web