PT-2018-9459 · Jenkins · Jenkins Badge Plugin+1

Publicado 2018-06-26 · Atualizado 2022-05-14 · CVE-2018-1000604

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Badge Plugin versions 1.4 and earlier

Description A persisted cross-site scripting issue exists in the Jenkins Badge Plugin, specifically in BadgeSummaryAction.java and HtmlBadgeAction.java, allowing attackers who can control build badge content to define JavaScript that would be executed in another user's browser when that user performs certain UI actions.

Recommendations For Jenkins Badge Plugin versions 1.4 and earlier, update to version 1.5 or newer, which sanitizes the provided HTML for display on the Jenkins web UI.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-1000604

GHSA-3XJQ-8J89-XRW9

Produtos afetados

Jenkins

Jenkins Badge Plugin

Referências · 6

• https://github.com/jenkinsci/badge-plugin · Nota
• https://github.com/jenkinsci/badge-plugin/commit/63a7744cef33338e62898576a50bcc521d76ba9f · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000604 · Nota de Segurança
• https://jenkins.io/security/advisory/2018-06-25/#SECURITY-906 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-3xjq-8j89-xrw9 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000604 · Aviso do Fabricante