CVE-2024-23905 - Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc

Back Back to CVE browser

HIGH

Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc

Published Jan 24, 2024

8.0

HIGH

CVSS 3.1

EPSS 0.56%

Description

Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.

Affected products

Vendor Jenkins Project Product Jenkins Red Hat Dependency Analytics Plugin Default
unaffected
Affected
- ≥ 0, ≤ 0.7.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins Project	Jenkins Red Hat Dependency Analytics Plugin	unaffected	Affected ≥ 0, ≤ 0.7.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

http://www.openwall.com/lists/oss-security/2024/01/24/6
Mailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-0455
Advisory
https://github.com/advisories/GHSA-x22x-5pp9-8v7f
Advisory
https://github.com/jenkinsci/redhat-dependency-analytics-plugin/commit/123e37795eb69f533a1cd8bd74113ebb1fdbdcda
https://nvd.nist.gov/vuln/detail/CVE-2024-23905
https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3322
vendor-advisoryVendor Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2024/01/24/6		Mailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-0455		Advisory
https://github.com/advisories/GHSA-x22x-5pp9-8v7f		Advisory
https://github.com/jenkinsci/redhat-dependency-analytics-plugin/commit/123e37795eb69f533a1cd8bd74113ebb1fdbdcda
https://nvd.nist.gov/vuln/detail/CVE-2024-23905
https://www.jenkins.io/security/advisory/2024-01-24/#SECURITY-3322		vendor-advisoryVendor Advisory