MEDIUM
jenkins: Cross-site scripting vulnerability in confirmation dialogs displaying item names (SECURITY-759)
Published Apr 13, 2018
5.4
MEDIUMCVSS 3.0
EPSS 0.87%
Description
A cross-site scripting vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in confirmationList.jelly and stopButton.jelly that allows attackers with Job/Configure and/or Job/Create permission to create an item name containing JavaScript that would be executed in another user's browser when that other user performs some UI actions.
Affected products
Remediation
No remediation recorded yet.
Weaknesses (1)
References (9)
- https://access.redhat.com/security/cve/CVE-2018-1000170 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1566950 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3401 Advisory
- https://github.com/advisories/GHSA-9jcv-v4jp-w3cq Advisory
- https://github.com/jenkinsci/jenkins/commit/07d18cfd6d336a2b7cc0a78e120d9739a5d4e1d1
- https://jenkins.io/security/advisory/2018-04-11/
- https://jenkins.io/security/advisory/2018-04-11/#SECURITY-759 x_refsource_CONFIRMVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000170
- https://www.cve.org/CVERecord?id=CVE-2018-1000170
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Apr 13, 2018
Updated Aug 5, 2024
Reserved Apr 11, 2018
Link CVE-2018-1000170
CISA Vulnrichment
No data
GitHub
Link GHSA-9JCV-V4JP-W3CQ