CVE-2023-28670

HIGH8.0EPSS 10.1%

Jenkins Pipeline Aggregator View Plugin vulnerable to Cross-site Scripting

Published: 4/2/2023Modified: 11/8/2023

Description

Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission. Version 1.14 obtains the current URL in a way not susceptible to XSS.

Affected packages (1)

Maven/com.paul8620.jenkins.plugins:pipeline-aggregator-viewfrom 0, < 1.14

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.0	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References (3)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-28670
PATCHhttps://github.com/jenkinsci/pipeline-aggregator-view-plugin
WEBhttps://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2885