Description
Jenkins Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom Build Properties and Build Summary pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set or change these values.
Published: 2022-12-07
Score: 5.4 Medium
EPSS: 9.0% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2022-7515 Jenkins Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom Build Properties and Build Summary pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set or change these values.
Github GHSA Github GHSA GHSA-5g2c-j6v9-vf94 Jenkins Custom Build Properties Plugin vulnerable to Cross-site Scripting
History

Wed, 23 Apr 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Jenkins Custom Build Properties
cve-icon MITRE

Status: PUBLISHED

Assigner: jenkins

Published:

Updated: 2025-04-23T15:43:14.301Z

Reserved: 2022-12-06T00:00:00.000Z

Link: CVE-2022-46686

cve-icon Vulnrichment

Updated: 2024-08-03T14:39:38.677Z

cve-icon NVD

Status : Modified

Published: 2022-12-12T09:15:13.137

Modified: 2025-04-23T16:15:28.567

Link: CVE-2022-46686

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses