What is GHSA-rvg5-f5fj-mxvg?

GHSA-rvg5-f5fj-mxvg is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site Scripting in Jenkins Credentials Plugin

Which CVE IDs does GHSA-rvg5-f5fj-mxvg cover?

GHSA-rvg5-f5fj-mxvg covers the following CVE IDs: CVE-2022-29036. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rvg5-f5fj-mxvg?

GHSA-rvg5-f5fj-mxvg has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-rvg5-f5fj-mxvg?

GHSA-rvg5-f5fj-mxvg affects 4 products, including: maven/org.jenkins-ci.plugins:credentials:\u003c= 2.6.1; maven/org.jenkins-ci.plugins:credentials:\u003e= 2.6.2, \u003c= 1074.v60e6c29b; maven/org.jenkins-ci.plugins:credentials:= 1087.v16065d268466; maven/org.jenkins-ci.plugins:credentials:\u003e= 1105, \u003c= 1111.v35a.

GHSA-rvg5-f5fj-mxvgMediumCVSS 5.4

Cross-site Scripting in Jenkins Credentials Plugin

Vendor

GitHub Security Advisories

Published

April 13, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-29036 →

📋 Description

Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

🎯 Affected products4

maven/org.jenkins-ci.plugins:credentials:<= 2.6.1
maven/org.jenkins-ci.plugins:credentials:>= 2.6.2, <= 1074.v60e6c29b
maven/org.jenkins-ci.plugins:credentials:= 1087.v16065d268466
maven/org.jenkins-ci.plugins:credentials:>= 1105, <= 1111.v35a

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2022-29036
https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
https://github.com/advisories/GHSA-rvg5-f5fj-mxvg