HTML Injection Vulnerability in AWS CodeCommit Trigger Plugin for Jenkins
CVE-2023-41944

6.1MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Aws Codecommit Trigger Plugin
Vendor
CVE Published:
6 September 2023

Summary

The AWS CodeCommit Trigger Plugin for Jenkins allows for HTML injection due to improper escaping of the queue name parameter in the form validation URL. This occurs during the rendering of error messages and can be exploited by an attacker to introduce malicious HTML content. Users are advised to upgrade to the latest version to mitigate the risk associated with this vulnerability.

Affected Version(s)

Jenkins AWS CodeCommit Trigger Plugin 0 <= 3.0.12

References

https://www.jenkins.io/security/advisory/2023-09-06/#SECU...
vendor-advisory
http://www.openwall.com/lists/oss-security/2023/09/06/9

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.