~ / search / GHSA-jwx3-2hq3-682c

GHSA-jwx3-2hq3-682c

Jenkins Edgewall Trac Plugin vulnerable to Stored XSS

Source: GitHub Advisory Database (reviewed) High CVE-2023-46659

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:trac <= 1.13 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix.

References

External links from the advisory. They lead to third-party sites.