Stored XSS Vulnerability in Jenkins Promoted Builds Plugin by CloudBees
CVE-2022-25202

4.8MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Promoted Builds (simple) Plugin
Vendor
CVE Published:
15 February 2022

Summary

The Jenkins Promoted Builds (Simple) Plugin prior to version 1.9 contains a stored cross-site scripting vulnerability due to insufficient escaping of the names of custom promotion levels. Attackers with Overall/Administer permissions can exploit this flaw to inject malicious scripts that are executed when users interact with the affected elements, posing a significant security risk in managed environments.

Affected Version(s)

Jenkins Promoted Builds (Simple) Plugin <= 1.9

References

https://www.jenkins.io/security/advisory/2022-02-15/#SECU...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.