Stored Cross-Site Scripting Vulnerability in Jenkins Extended Choice Parameter Plugin
CVE-2022-27202

5.4MEDIUM

Key Information:

Vendor

Jenkins
Status
Jenkins Extended Choice Parameter Plugin
Vendor
CVE Published:
15 March 2022

What is CVE-2022-27202?

The Extended Choice Parameter Plugin for Jenkins contains a stored cross-site scripting vulnerability that can be exploited by users with Item/Configure permissions. Specifically, the plugin fails to correctly escape the values and descriptions for radio button and checkbox types. As a result, malicious actors can inject arbitrary JavaScript into the application's stored data, potentially leading to unauthorized access and the execution of scripts in the context of other users who interact with affected parameters.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Jenkins Extended Choice Parameter Plugin <= 346.vd87693c5a_86c

References

https://www.jenkins.io/security/advisory/2022-03-15/#SECU...
x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2022/03/15/2
mailing-listx_refsource_MLIST

EPSS Score

8% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.