GHSA-874r-46c6-7p4r

Stored Cross-site Scripting vulnerability in Jenkins Favorite Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-27196

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jvnet.hudson.plugins:favorite	< 2.4.1	2.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-27196 advisory
https://github.com/jenkinsci/favorite-plugin/commit/543a4d87c4fade02173f793905a99adec517bc3b web
https://github.com/jenkinsci/favorite-plugin package
https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2557 web
http://www.openwall.com/lists/oss-security/2022/03/15/2 web