GHSA-h8hf-hxx6-5g6v

Cross-site Scripting in Jenkins Naginator Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-45382

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:naginator	< 1.18.2	1.18.2

Details

As written in the advisory (Markdown source, shown as plain text).

Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to edit build display names. Naginator Plugin 1.18.2 escapes display names of source builds.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-45382 advisory
https://github.com/jenkinsci/naginator-plugin/commit/c335cdd1562333898216bbe137bbe2991c6a225f web
https://github.com/jenkinsci/naginator-plugin package
https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2946 web
http://www.openwall.com/lists/oss-security/2022/11/15/4 web