PT-2018-9370 · Jenkins · Jenkins Groovy Postbuild Plugin+1

Publicado 2018-06-05 · Atualizado 2022-05-14 · CVE-2018-1000202

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Groovy Postbuild Plugin versions 2.3.1 and older

Description A persisted cross-site scripting issue exists in various Jelly files, allowing attackers who can control build badge content to define JavaScript that would be executed in another user's browser when that user performs certain UI actions.

Recommendations For versions 2.3.1 and older, update to a version newer than 2.3.1 to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-1000202

GHSA-38CH-X695-M794

Produtos afetados

Jenkins

Jenkins Groovy Postbuild Plugin

Referências · 4

• https://jenkins.io/security/advisory/2018-05-09/#SECURITY-821 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000202 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1000202 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-38ch-x695-m794 · Aviso do Fabricante