Reflected Cross-Site Scripting Vulnerability in Jenkins Nested View Plugin
CVE-2022-34182

6.1MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Nested View Plugin
Vendor
CVE Published:
23 June 2022

Summary

The Nested View Plugin for Jenkins, versions 1.20 through 1.25, is vulnerable to reflected cross-site scripting (XSS) attacks due to improper escaping of search parameters. This vulnerability allows attackers to inject malicious scripts into the search fields, potentially leading to unauthorized actions on behalf of users. It is essential for Jenkins administrators to upgrade the plugin to a secure version to mitigate potential risks.

Affected Version(s)

Jenkins Nested View Plugin 1.20

Jenkins Nested View Plugin <= 1.25

References

https://www.jenkins.io/security/advisory/2022-06-22/#SECU...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.