First published: Tue Mar 15 2022(Updated: )
Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parameters of radio buttons or check boxes type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
Affected Software | Affected Version | How to fix |
---|---|---|
Jenkins Extended Choice Parameter | <=346.vd87693c5a_86c |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2022-27202 is classified as a medium severity vulnerability due to its potential for stored cross-site scripting (XSS).
To remediate CVE-2022-27202, update the Jenkins Extended Choice Parameter Plugin to version 347 or later, which addresses the XSS vulnerability.
CVE-2022-27202 affects Jenkins users who have the Extended Choice Parameter Plugin version 346.vd87693c5a_86c or earlier installed.
CVE-2022-27202 affects the value and description of extended choice parameters specifically for radio buttons and check boxes.
Yes, CVE-2022-27202 can be exploited by attackers with Item/Configure permission, allowing them to execute XSS attacks.