Stored Cross-Site Scripting Vulnerability in Jenkins GitHub Plugin
CVE-2023-46650

5.4MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Github Plugin
Vendor
CVE Published:
25 October 2023

Summary

The Jenkins GitHub Plugin allows for integration with GitHub repositories. However, versions 1.37.3 and earlier contain a vulnerability where the GitHub project URL in the build page is not properly escaped. This oversight may allow attackers with Item/Configure permissions to execute arbitrary JavaScript in the context of users viewing the build page, leading to potential data exposure and session hijacking. Organizations utilizing affected versions of the plugin are advised to review their user permission settings and consider upgrading to the latest secure version.

Affected Version(s)

Jenkins GitHub Plugin 0 <= 1.37.3

References

https://www.jenkins.io/security/advisory/2023-10-25/#SECU...
vendor-advisory
http://www.openwall.com/lists/oss-security/2023/10/25/2

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.