Skip to content
Sign in
5.4 Medium

CVE-2023-30520 Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via…

Description

Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads.

Affected products and versions

Product Affected versions Fixed in
Jenkins Quay.io trigger Plugin 0.1 earliest → 0.1 No fix stated

Other CVEs of Jenkins Quay.io trigger Plugin

The 2 CVEs of Jenkins Quay.io trigger Plugin →
CVE-2023-30519 A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger… 5.3 Medium
Track this CVE