Stored Cross-Site Scripting in Jenkins Dashboard View Plugin
CVE-2022-27197

5.4MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Dashboard View Plugin
Vendor
CVE Published:
15 March 2022

What is CVE-2022-27197?

The Jenkins Dashboard View Plugin versions up to 2.18 lack proper URL validation for the Iframe Portlet's Iframe source URL. This absence of validation potentially allows attackers to exploit the system by configuring views, leading to a stored cross-site scripting vulnerability. It is critical for users of these versions to upgrade to mitigate the risk associated with this security flaw.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Jenkins Dashboard View Plugin <= 2.18

Jenkins Dashboard View Plugin 2.16.1

Jenkins Dashboard View Plugin 2.17.1

References

https://www.jenkins.io/security/advisory/2022-03-15/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2022/03/15/2
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.