Cross site scripting in Jenkins build-metrics Plugin
High severity
GitHub Reviewed
Published
Jul 1, 2022
to the GitHub Advisory Database
•
Updated Feb 2, 2023
Description
Published by the National Vulnerability Database
Jun 30, 2022
Published to the GitHub Advisory Database
Jul 1, 2022
Reviewed
Jul 12, 2022
Last updated
Feb 2, 2023
Jenkins build-metrics Plugin 1.3 does not escape the build description on one of its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Build/Update permission.
References