CVE-2022-41240

Summary

Jenkins Walti Plugin 1.0.1 and earlier does not escape the information provided by the Walti API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide malicious API responses from Walti.

Affected Software

VendorProductVersion RangeStatus
Jenkins projectJenkins Walti Pluginunspecified <= 1.0.1affected
Jenkins projectJenkins Walti Pluginnext of 1.0.1 < unspecifiedunknown

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References