PT-2018-9340 · Cloudbees+1 · Jenkins

Jesper Den Boer · Publicado 2018-04-13 · Atualizado 2022-05-14 · CVE-2018-1000170

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.115 and older Jenkins LTS versions 2.107.1 and older

Description A cross-site scripting issue exists in confirmationList.jelly and stopButton.jelly, allowing attackers with Job/Configure and/or Job/Create permission to create an item name containing JavaScript. This JavaScript would be executed in another user's browser when that other user performs certain UI actions.

Recommendations For Jenkins versions 2.115 and older, update to a version newer than 2.115 to resolve the issue. For Jenkins LTS versions 2.107.1 and older, update to a version newer than 2.107.1 to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-1000170

GHSA-9JCV-V4JP-W3CQ

Produtos afetados

Jenkins

Referências · 6

• https://github.com/jenkinsci/jenkins/commit/07d18cfd6d336a2b7cc0a78e120d9739a5d4e1d1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000170 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000170 · Nota
• https://osv.dev/vulnerability/CVE-2018-1000170 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2018-04-11/#SECURITY-759 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-9jcv-v4jp-w3cq · Aviso do Fabricante