CVE-2022-27197: XSS
First published: Tue Mar 15 2022(Updated: )
Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.jenkins-ci.plugins:dashboard-view | <2.18.1 | 2.18.1 |
| Jenkins Dashboard View | <2.18.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2022/03/15/2
- https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2559
- https://nvd.nist.gov/vuln/detail/CVE-2022-27197
- https://github.com/jenkinsci/dashboard-view-plugin/commit/942c5c78fa834a6be242f144adc2b7f045ccdbc3
- https://github.com/advisories/GHSA-6fg4-36v7-xv32 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for Jenkins Dashboard View Plugin?
The vulnerability ID for Jenkins Dashboard View Plugin is CVE-2022-27197.
What is the severity of CVE-2022-27197?
The severity of CVE-2022-27197 is medium with a CVSS score of 5.4.
How does the vulnerability in Jenkins Dashboard View Plugin manifest?
The vulnerability in Jenkins Dashboard View Plugin manifests as a stored cross-site scripting (XSS) vulnerability.
Which versions of Jenkins Dashboard View Plugin are affected by this vulnerability?
Jenkins Dashboard View Plugin version 2.18 and earlier are affected by this vulnerability.
How can the vulnerability in Jenkins Dashboard View Plugin be exploited?
The vulnerability in Jenkins Dashboard View Plugin can be exploited by attackers who are able to configure views in the application.
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-6fg4-36v7-xv32
- alias/CVE-2022-27197
- collector/github-advisory
- collector/nvd-cve
- collector/nvd-api
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/trending
- agent/tags
- agent/source
- vendor/jenkins
- canonical/jenkins dashboard view
- package-manager/maven