CVE-2018-1000413 - A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins

Back Back to CVE browser

MEDIUM

A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins

Published Jan 9, 2019

5.4

MEDIUM

CVSS 3.1

EPSS 0.95%

Description

A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

http://www.securityfocus.com/bid/106532
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-vwfm-42q6-qj75
Advisory
https://github.com/jenkinsci/config-file-provider-plugin/commit/5c1df554e44b712e5d926b8d5557c592bf9f0a33
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1080
x_refsource_CONFIRMThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000413

Link	Providers	Tags
http://www.securityfocus.com/bid/106532		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-vwfm-42q6-qj75		Advisory
https://github.com/jenkinsci/config-file-provider-plugin/commit/5c1df554e44b712e5d926b8d5557c592bf9f0a33
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1080		x_refsource_CONFIRMThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000413