Stored XSS Vulnerability in Jenkins CRX Content Package Deployer Plugin

CVE-2022-34184

Summary

The Jenkins CRX Content Package Deployer Plugin versions 1.9 and earlier contain a stored cross-site scripting vulnerability. The vulnerability arises from the lack of proper escaping of the name and description fields of CRX Content Package Choice parameters on user-facing views. This flaw can be exploited by attackers who have Item/Configure permissions, allowing them to inject malicious scripts, which could be executed in the context of other users' sessions, compromising sensitive information and potentially leading to further exploits.

References