Not rated
CVE-2022-27196 Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a…
Description
Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Favorite Plugin 2.4 | earliest → 2.4.0 | No fix stated |
| Jenkins Favorite Plugin 2.3 | earliest → < 2.3.3.1 | 2.3.3.1 |