Stored Cross-site Scripting vulnerability in Jenkins global-build-stats Plugin
Moderate severity
GitHub Reviewed
Published
Mar 16, 2022
to the GitHub Advisory Database
•
Updated Dec 28, 2023
Package
Affected versions
<= 1.5
Patched versions
None
Description
Published by the National Vulnerability Database
Mar 15, 2022
Published to the GitHub Advisory Database
Mar 16, 2022
Reviewed
Nov 30, 2022
Last updated
Dec 28, 2023
Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
References