CoreCVE
Back

MEDIUM

A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containing JavaScript that would be executed in another user's browser when that user performs some UI actions

Published May 8, 2018

Description

A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containing JavaScript that would be executed in another user's browser when that user performs some UI actions.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published May 8, 2018
Updated Sep 17, 2024
Reserved May 8, 2018
Link CVE-2018-1000177
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-1000177
Red Hat
Severity n/a
Public date n/a
Links CVE-2018-1000177
ENISA EUVD
Assigner mitre
Published May 8, 2018
Updated Sep 17, 2024
Exploited since n/a
Link EUVD-2022-2134
EUVD-2022-2134 GHSA-3892-QQV6-H2QM