What is GHSA-8294-mv9c-7m5h?

GHSA-8294-mv9c-7m5h is a security advisory published by GitHub Security Advisories with High severity. Stored XSS vulnerability in Jenkins Maven Metadata Plugin for Jenkins CI server plugin

Which CVE IDs does GHSA-8294-mv9c-7m5h cover?

GHSA-8294-mv9c-7m5h covers the following CVE IDs: CVE-2022-36905. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-8294-mv9c-7m5h?

GHSA-8294-mv9c-7m5h has a CVSS v3 base score of 8.0, published by GitHub Security Advisories.

Which products are affected by GHSA-8294-mv9c-7m5h?

GHSA-8294-mv9c-7m5h affects 1 product, including: maven/eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin:\u003c= 2.2.

GHSA-8294-mv9c-7m5hHighCVSS 8.0

Stored XSS vulnerability in Jenkins Maven Metadata Plugin for Jenkins CI server plugin

Vendor

GitHub Security Advisories

Published

July 28, 2022

Last Modified

January 28, 2023

🔗 CVE IDs covered (1)

CVE-2022-36905 →

📋 Description

Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

🎯 Affected products1

maven/eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin:<= 2.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-36905
https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2686
http://www.openwall.com/lists/oss-security/2022/07/27/1
https://github.com/advisories/GHSA-8294-mv9c-7m5h