5.4 Medium

CVE-2023-28679 Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a…

Description

Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expression, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Mashup Portlets Plugin 1.1	earliest → 1.1.2	No fix stated

The 2 CVEs of Jenkins Mashup Portlets Plugin →

CVE-2019-10347 Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users… Not rated

Do you use Jenkins Mashup Portlets Plugin?

Track this CVE Watch Jenkins Mashup Portlets Plugin Check my SBOMs

www.cveye.io/en/cve/CVE-2023-28679

Timeline

Published March 23, 2023
Last modified February 24, 2025

References

Jenkins Security Advisory 2023-03-21 www.jenkins.io

Track this CVE

CVE-2023-28679 Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a…

Description

Affected products and versions

Other CVEs of Jenkins Mashup Portlets Plugin