Stored Cross-Site Scripting in Jenkins Dashboard View Plugin
CVE-2022-27197

5.4MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Dashboard View Plugin
Vendor
CVE Published:
15 March 2022

Summary

The Jenkins Dashboard View Plugin versions up to 2.18 lack proper URL validation for the Iframe Portlet's Iframe source URL. This absence of validation potentially allows attackers to exploit the system by configuring views, leading to a stored cross-site scripting vulnerability. It is critical for users of these versions to upgrade to mitigate the risk associated with this security flaw.

Affected Version(s)

Jenkins Dashboard View Plugin <= 2.18

Jenkins Dashboard View Plugin 2.16.1

Jenkins Dashboard View Plugin 2.17.1

References

https://www.jenkins.io/security/advisory/2022-03-15/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2022/03/15/2
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.