Stored XSS vulnerability in Jenkins Generic Webhook Trigger Plugin

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2022-25185 · ADVISORY
• jenkinsci/generic-webhook-trigger-plugin commit b289c32 · WEB
• jenkinsci/generic-webhook-trigger-plugin · PACKAGE
• jenkins.io/security/advisory/2022-02-15 · WEB
• openwall.com/lists/oss-security/2022/02/15/2 · WEB

org.jenkins-ci.plugins:generic-webhook-trigger のその他の脆弱性

• CVE-2022-43412中 5.3Jenkins Generic Webhook Trigger Plugin 1.84.1 and earlier uses a non-constant time comparison function when checking whether the provided an…
• CVE-2021-21669緊急 9.8Jenkins Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.