CVE-2022-30968 - Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission

Back Back to CVE browser

HIGH

Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission

Published May 17, 2022

8.0

HIGH

CVSS 3.1

EPSS 0.79%

Description

Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected products

Vendor Jenkins project Product Jenkins vboxwrapper Plugin Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=1.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins vboxwrapper Plugin

n/a

Version	Status	Constraints
unspecified	affected	<=1.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3453
Advisory
https://github.com/advisories/GHSA-9w23-w757-mvv8
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-30968
https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3453		Advisory
https://github.com/advisories/GHSA-9w23-w757-mvv8		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-30968
https://www.jenkins.io/security/advisory/2022-05-17/#SECURITY-2717		x_refsource_CONFIRMVendor Advisory