Description (CNA)
Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Jenkins project / Jenkins Subversion Plugin | affected unspecified through 2.15.3 |
CWE
No CWE identifiers supplied.
References
- https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
- https://support.apple.com/kb/HT213345
- http://seclists.org/fulldisclosure/2022/Jul/18
ADP enrichment
No English description supplied.