Skip to content
Sign in
Not rated

CVE-2022-36902 Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended…

Description

Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected products and versions

Product Affected versions Fixed in
Jenkins Dynamic Extended Choice Parameter Plugin 1.0 earliest → 1.0.1 No fix stated

Other CVEs of Jenkins Dynamic Extended Choice Parameter Plugin

The 3 CVEs of Jenkins Dynamic Extended Choice Parameter Plugin →
CVE-2022-34186 Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded… Not rated CVE-2020-2124 Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files… Not rated
Track this CVE