Jenkins Applitools Eyes Plugin Stored Cross-Site Scripting Vulnerability
Vulnerability
A stored cross-site scripting vulnerability has been identified in the Jenkins Applitools Eyes Plugin, affecting versions through 1.16.5. The vulnerability arises because the plugin does not properly escape the Applitools URL on the build page. This issue is exploitable by attackers who have Item/Configure permission.
Impact
Exploitation of this vulnerability allows for stored cross-site scripting, where the injected script is executed in the context of the user viewing the build.
Remediation
Users of the Jenkins Applitools Eyes Plugin should update to version 1.16.6, which addresses this vulnerability by properly escaping URLs that could contain HTML metacharacters.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.