1. Home
  2. CVE Database
  3. CVE-2022-30970
MEDIUM · 5.4

CVE-2022-30970

Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitio...

Vulnerability Description

Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
JenkinsAutocomplete Parameter<= 1.1

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2022-30970?

CVE-2022-30970 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitio...

How severe is CVE-2022-30970?

CVE-2022-30970 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-30970?

Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Autocomplete Parameter.