Jenkins Badge vulnerabilities

2 CVEs affecting Jenkins Badge, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-23108, published 2022-01-12.

More from Jenkins.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-23108, published 2022-01-12. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. Jenkins Badge Plugin 1.9 and earlier does not escape the description and does not check for allowed protocols when creating a badge, resulting in a stored cross-site scripting (XSS) vulnerability…
• CVE-2018-1000604, published 2018-06-26. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows attackers able to control build badge…