~ / search / GHSA-8886-8v27-85j8

GHSA-8886-8v27-85j8

Stored XSS vulnerability in Jenkins Authorize Project Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2024-52552

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:authorize-project < 1.8.0 1.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Authorize Project Plugin 1.8.0 no longer evaluates a string containing the job name with JavaScript on the Authorization view.

References

External links from the advisory. They lead to third-party sites.