~ / search / GHSA-q9g4-9fx4-v533

GHSA-q9g4-9fx4-v533

Stored XSS vulnerability in Jenkins DotCi Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2022-41239

Packages

EcosystemPackageAffectedFixed in
Maven com.groupon.jenkins-ci.plugins:DotCi <= 2.40.00 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted commit notifications to the `/githook/` endpoint (see also [SECURITY-2867](https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2867)). This vulnerability is only exploitable in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.303/#SECURITY-2452).

References

External links from the advisory. They lead to third-party sites.