CVE-2018-1000108 - A cross-site scripting vulnerability exists in Jenkins CppNCSS Plugin 1.1 and earlier in AbstractProjectAction/index.jelly that allow an attacker to craft links to Jenkins URLs that run arbitrary JavaScript in the user's browser when accessed

Back Back to CVE browser

MEDIUM

A cross-site scripting vulnerability exists in Jenkins CppNCSS Plugin 1.1 and earlier in AbstractProjectAction/index.jelly that allow an attacker to craft links to Jenkins URLs that run arbitrary JavaScript in the user's browser when accessed

Published Mar 13, 2018

6.1

MEDIUM

CVSS 3.0

EPSS 0.83%

Description

A cross-site scripting vulnerability exists in Jenkins CppNCSS Plugin 1.1 and earlier in AbstractProjectAction/index.jelly that allow an attacker to craft links to Jenkins URLs that run arbitrary JavaScript in the user's browser when accessed.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://github.com/advisories/GHSA-xgmh-rvpw-6498
Advisory
https://jenkins.io/security/advisory/2018-02-26/#SECURITY-712
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000108

Link	Providers	Tags
https://github.com/advisories/GHSA-xgmh-rvpw-6498		Advisory
https://jenkins.io/security/advisory/2018-02-26/#SECURITY-712		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000108