PT-2019-8737 · Jenkins · Jenkins Git Changelog Plugin+1

Daniel Beck · Publicado 2019-01-09 · Atualizado 2022-05-13 · CVE-2018-1000426

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Git Changelog Plugin versions 2.6 and earlier

Description A cross-site scripting issue exists that allows attackers to control the Git history parsed by the plugin, enabling them to have Jenkins render arbitrary HTML on some pages. This occurs in files such as GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, and GitLogBasicChangelogPostPublisher/config.jelly.

Recommendations For Jenkins Git Changelog Plugin versions 2.6 and earlier, consider disabling the plugin until a patch is available to prevent exploitation. Restrict access to the plugin's functionality to minimize the risk of arbitrary HTML rendering. Avoid using the plugin to parse untrusted Git history until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-1000426

GHSA-JCMG-9RW5-9RM2

Produtos afetados

Jenkins

Jenkins Git Changelog Plugin

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000426 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-jcmg-9rw5-9rm2 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1122 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000426 · Aviso do Fabricante
• http://securityfocus.com/bid/106532 · Nota