GHSA-qqwx-hcp6-25vr

Stored XSS vulnerability in Jenkins Generic Webhook Trigger Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-25185

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:generic-webhook-trigger	< 1.82	1.82

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Generic Webhook Trigger Plugin 1.81 and earlier does not escape the build cause when using the webhook, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-25185 advisory
https://github.com/jenkinsci/generic-webhook-trigger-plugin/commit/b289c32aa74439f3a8deb7674128a3a6fd90a61c web
https://github.com/jenkinsci/generic-webhook-trigger-plugin package
https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2592 web
http://www.openwall.com/lists/oss-security/2022/02/15/2 web