[MAVEN:GHSA-XQPP-26PP-2365] XSS vulnerability in Jenkins Markdown Formatter Plugin
Severity
Moderate
Affected Packages
1
Fixed Packages
1
CVEs
1
Jenkins Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter.
Jenkins Markdown Formatter Plugin 0.2.0 uses a different Markdown library that is not affected by this problem.
Package | Affected Version |
---|---|
pkg:maven/io.jenkins.plugins/markdown-formatter | <= 0.1.0 |
Package | Fixed Version |
---|---|
pkg:maven/io.jenkins.plugins/markdown-formatter | = 0.2.0 |
- ID
- MAVEN:GHSA-XQPP-26PP-2365
- Severity
- moderate
- URL
- https://github.com/advisories/GHSA-xqpp-26pp-2365
- Published
-
2022-05-24T19:03:11
(2 years ago) - Modified
-
2023-12-22T13:26:52
(9 months ago) - Rights
- Maven Security Team
- Other Advisories
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:maven/io.jenkins.plugins/markdown-formatter | io.jenkins.plugins | markdown-formatter | <= 0.1.0 | |||
Fixed | pkg:maven/io.jenkins.plugins/markdown-formatter | io.jenkins.plugins | markdown-formatter | = 0.2.0 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |