Stored Cross-Site Scripting Vulnerability in Jenkins Extended Choice Parameter Plugin
CVE-2022-27202

5.4MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Extended Choice Parameter Plugin
Vendor
CVE Published:
15 March 2022
đź”” Create Jenkins Vulnerability Alert

What is CVE-2022-27202?

The Extended Choice Parameter Plugin for Jenkins contains a stored cross-site scripting vulnerability that can be exploited by users with Item/Configure permissions. Specifically, the plugin fails to correctly escape the values and descriptions for radio button and checkbox types. As a result, malicious actors can inject arbitrary JavaScript into the application's stored data, potentially leading to unauthorized access and the execution of scripts in the context of other users who interact with affected parameters.

Affected Version(s)

Jenkins Extended Choice Parameter Plugin <= 346.vd87693c5a_86c

References

https://www.jenkins.io/security/advisory/2022-03-15/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2022/03/15/2
mailing-listx_refsource_MLIST

EPSS Score

14% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.