~ / search / GHSA-rfrq-3v89-fqg6

GHSA-rfrq-3v89-fqg6

Reflected XSS in Jenkins Compatibility Action Storage Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-2217

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:compatibility-action-storage <= 1.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.

References

External links from the advisory. They lead to third-party sites.