CVE-2022-43420

https://notcve.org/view.php?id=CVE-2022-43420

Jenkins Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control or modify Contrast service API responses. Jenkins Contrast Continuous Application Security Plugin versiones 3.9 y anteriores, no escapa de los datos devueltos por el servicio Contrast cuando es generado un informe, resultando en una vulnerabilidad de tipo cross-site scripting (XSS) almacenados, explotable por atacantes capaces de controlar o modificar las respuestas de la API del servicio Contrast • http://www.openwall.com/lists/oss-security/2022/10/19/3 https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2836 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •