CVE-2022-30956

Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS)…

published May 17, 2022

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.5th percentile for exploit probability.

CVSS
—
EPSS
73%
Percentile
99.5
In the wild
Unconfirmed
What it is

Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.73254 · 99.5th percentile
Published
2022-05-17T14:06Z
EPSS history
Timeline
  • 17 MAY 14:06Z
    Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS)…
    cvelistv5