Description
Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Remediation
References
http://www.openwall.com/lists/oss-security/2022/07/27/1
https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2682
Related Vulnerabilities
CVE-2022-31190 Vulnerability in maven package org.dspace:dspace-xmlui
CVE-2022-36910 Vulnerability in maven package org.jenkins-ci.plugins:lucene-search
CVE-2022-24815 Vulnerability in npm package generator-jhipster
CVE-2020-28480 Vulnerability in npm package jointjs
CVE-2020-2118 Vulnerability in maven package org.jenkins-ci.plugins:pipeline-githubnotify-step