Description
Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Remediation
References
http://www.openwall.com/lists/oss-security/2022/07/27/1
https://www.jenkins.io/security/advisory/2022-07-27/#SECURITY-2686
Related Vulnerabilities
CVE-2019-15657 Vulnerability in npm package eslint-utils
CVE-2021-21641 Vulnerability in maven package org.jenkins-ci.plugins:promoted-builds
CVE-2021-31404 Vulnerability in maven package com.vaadin:flow-server
CVE-2019-14653 Vulnerability in maven package org.webjars.npm:editor.md
CVE-2023-37962 Vulnerability in maven package io.jenkins.plugins:benchmark-evaluator