~ / search / GHSA-3rrx-364r-6wf6

GHSA-3rrx-364r-6wf6

Cross-site Scripting in Jenkins Spring Config Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2022-46687

Packages

EcosystemPackageAffectedFixed in
Maven io.jenkins.plugins:spring-config < 2.0.1 2.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to change build display names. Spring Config Plugin 2.0.1 escapes build display names shown on the Spring Config view.

References

External links from the advisory. They lead to third-party sites.