Stored Cross-Site Scripting Vulnerability in Jenkins Extended Choice Parameter Plugin
CVE-2022-27202

5.4MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Extended Choice Parameter Plugin
Vendor
CVE Published:
15 March 2022

Summary

The Extended Choice Parameter Plugin for Jenkins contains a stored cross-site scripting vulnerability that can be exploited by users with Item/Configure permissions. Specifically, the plugin fails to correctly escape the values and descriptions for radio button and checkbox types. As a result, malicious actors can inject arbitrary JavaScript into the application's stored data, potentially leading to unauthorized access and the execution of scripts in the context of other users who interact with affected parameters.

Affected Version(s)

Jenkins Extended Choice Parameter Plugin <= 346.vd87693c5a_86c

References

https://www.jenkins.io/security/advisory/2022-03-15/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2022/03/15/2
mailing-listx_refsource_MLIST

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.