Skip to content
Sign in
Not rated

CVE-2022-27197 Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source…

Description

Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.

Affected products and versions

Product Affected versions Fixed in
Jenkins Dashboard View Plugin 2.18 earliest → 2.18 No fix stated
Jenkins Dashboard View Plugin 2.17 earliest → < 2.17.1 2.17.1
Jenkins Dashboard View Plugin 2.16 earliest → < 2.16.1 2.16.1

Other CVEs of Jenkins Dashboard View Plugin

The 3 CVEs of Jenkins Dashboard View Plugin →
CVE-2021-21649 Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in… Not rated CVE-2019-10396 Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting… Not rated
Track this CVE