Medium · 6.1 CVE-2019-10346 EUVD-2022-3289GHSA-94rj-c4jj-v476

Jenkins Embeddable Build Status Plugin contains Cross-site Scripting

Published Jul 11, 2019 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Embeddable Build Status Plugin Package: io.jenkins.plugins:embeddable-build-status-plugin Category: Web / CMS Ecosystem: Maven

Description

A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Embeddable Build Status Plugin	2.0.1 and earlier	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	io.jenkins.plugins:embeddable-build-status-plugin	< 2.0.2	2.0.2	GHSA-94rj-c4jj-v476

References

[oss-security] 20190711 Multiple vulnerabilities in Jenkins plugins mailing-list
109156 vdb-entry
https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1419