5.4
Medium
CVE-2023-30520 Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via…
Description
Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhooks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Quay.io trigger webhook payloads.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Jenkins Quay.io trigger Plugin 0.1 | earliest → 0.1 | No fix stated |
References
- Jenkins Security Advisory 2023-04-12 www.jenkins.io
- www.openwall.com www.openwall.com
Timeline
- Published
- Last modified