GHSA-vqp8-h53h-3jfhMediumCVSS 4.8

Stored XSS vulnerability in Jenkins VncRecorder Plugin

Published
May 24, 2022
Last Modified
November 4, 2023

🔗 CVE IDs covered (1)

CVE-2020-2205 →

📋 Description

VncRecorder Plugin 1.25 and earlier does not escape a tool path in the checkVncServ form validation endpoint accessed e.g. via job configuration forms.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by Jenkins administrators.

VncRecorder Plugin 1.35 escapes the tool path.

🎯 Affected products1

  • maven/org.jenkins-ci.plugins:vncrecorder:<= 1.25

🔗 References (4)