GHSA-39r3-h8q6-2phqHighCVSS 8.8

Reflected Cross site scripting in Jenkins Embeddable Build Status Plugin

Published
June 24, 2022
Last Modified
January 31, 2023

🔗 CVE IDs covered (1)

CVE-2022-34178 →

📋 Description

Jenkins Embeddable Build Status Plugin 2.0.3 allows specifying a 'link' query parameter that build status badges will link to, without restricting possible values, resulting in a reflected cross-site scripting (XSS) vulnerability.

Embeddable Build Status Plugin 2.0.4 limits URLs to http and https protocols and correctly escapes the provided value.

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:embeddable-build-status:< 2.0.4

🔗 References (4)