~ / search / GHSA-4m42-8qfq-h3q9

GHSA-4m42-8qfq-h3q9

Cross-site Scripting in Jenkins Rundeck Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2022-30956

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:rundeck < 3.6.11 3.6.11

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads. Rundeck Plugin 3.6.11 sanitizes URLs submitted in Rundeck webhook payloads.

References

External links from the advisory. They lead to third-party sites.