Skip to content
Sign in
5.4 Medium

CVE-2022-41239 Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications…

Description

Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting (XSS) vulnerability.

Affected products and versions

Product Affected versions Fixed in
Jenkins DotCi Plugin 2.40 earliest → 2.40.00 No fix stated

Other CVEs of Jenkins DotCi Plugin

The 3 CVEs of Jenkins DotCi Plugin →
CVE-2022-41238 A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger… 9.8 Critical CVE-2022-41237 Jenkins DotCi Plugin 2.40.00 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary… 9.8 Critical
Track this CVE