GHSA-5qx5-vg5w-5mx3MediumCVSS 5.4

Stored XSS vulnerability in Jenkins Badge Plugin

Published
January 13, 2022
Last Modified
October 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-23108 →

📋 Description

Jenkins Badge Plugin 1.9 and earlier does not escape the description and does not check for allowed protocols when creating a badge, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:badge:< 1.9.1

🔗 References (4)