CVE-2018-1000202 - A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions

Back Back to CVE browser

MEDIUM

A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions

Published Jun 5, 2018

5.4

MEDIUM

CVSS 3.0

EPSS 0.72%

Description

A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2135
Advisory
https://github.com/advisories/GHSA-38ch-x695-m794
Advisory
https://jenkins.io/security/advisory/2018-05-09/#SECURITY-821
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000202

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2135		Advisory
https://github.com/advisories/GHSA-38ch-x695-m794		Advisory
https://jenkins.io/security/advisory/2018-05-09/#SECURITY-821		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000202