CVE-2022-34790: XSS
First published: Thu Jun 30 2022(Updated: )
Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Extreme Feedback Panel | <=2.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this Jenkins eXtreme Feedback Panel Plugin issue?
The vulnerability ID for this Jenkins eXtreme Feedback Panel Plugin issue is CVE-2022-34790.
What is the severity rating of CVE-2022-34790?
CVE-2022-34790 has a severity rating of medium.
What is the CWE ID associated with CVE-2022-34790?
The CWE ID associated with CVE-2022-34790 is CWE-79 (Cross-site Scripting).
How does CVE-2022-34790 affect Jenkins eXtreme Feedback Panel Plugin?
CVE-2022-34790 affects Jenkins eXtreme Feedback Panel Plugin versions 2.0.1 and earlier.
Is there a fix available for CVE-2022-34790?
Yes, a fix is available for CVE-2022-34790. Users should update to a version later than 2.0.1 of Jenkins eXtreme Feedback Panel Plugin.
- collector/nvd-index
- collector/nvd-api
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/jenkins
- canonical/jenkins extreme feedback panel
- version/jenkins extreme feedback panel/2.0.1