Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2022-36905

UNKNOWN
Published 2022-07-27T14:25:53
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2022-36905. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

Jenkins project

Jenkins Maven Metadata Plugin for Jenkins CI server Plugin

Affected Versions:

unspecified next of 2.2

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed HIGH

Stored XSS vulnerability in Jenkins Maven Metadata Plugin for Jenkins CI server plugin

GHSA-8294-mv9c-7m5h

Advisory Details

Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected Packages

Maven eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin
ECOSYSTEM: ≥0 ≤2.2

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-36905
PACKAGE https://github.com/jenkinsci/maven-metadata-plugin
WEB https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2686
WEB http://www.openwall.com/lists/oss-security/2022/07/27/1

Advisory provided by GitHub Security Advisory Database. Published: July 28, 2022, Modified: December 12, 2022

References

https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2686
http://www.openwall.com/lists/oss-security/2022/07/27/1
Published: 2022-07-27T14:25:53
Last Modified: 2024-08-03T10:14:29.459Z
Copied to clipboard!