Skip to content
Sign in
Not rated

CVE-2022-34186 Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded…

Description

Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape the name and description of Moded Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Affected products and versions

Product Affected versions Fixed in
Jenkins Dynamic Extended Choice Parameter Plugin 1.0 earliest → 1.0.1 No fix stated

Other CVEs of Jenkins Dynamic Extended Choice Parameter Plugin

The 3 CVEs of Jenkins Dynamic Extended Choice Parameter Plugin →
CVE-2022-36902 Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended… Not rated CVE-2020-2124 Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files… Not rated
Track this CVE