PT-2018-9316 · Jenkins · Jenkins Cucumber Living Documentation Plugin+1

Daniel Beck · Published 2018-04-05 · Updated 2022-05-14 · CVE-2018-1000144

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Cucumber Living Documentation Plugin versions 1.0.12 and older

Description A cross-site scripting issue exists in the CukedoctorBaseAction#doDynamic function, which disables Content-Security-Policy protection for archived artifacts and workspace files. This allows attackers who can control the content of these files to attack Jenkins users.

Recommendations For Jenkins Cucumber Living Documentation Plugin versions 1.0.12 and older, update to version 1.1.0 or newer, and change the Content-Security-Policy option in Jenkins as requested by the plugin.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-1000144

GHSA-Q7JX-R75R-HGJ2

Affected Products

Jenkins

Jenkins Cucumber Living Documentation Plugin

References · 5

• https://jenkins.io/security/advisory/2018-03-26/#SECURITY-308 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000144 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000144 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q7jx-r75r-hgj2 · Vendor Advisory
• https://github.com/jenkinsci/cucumber-living-documentation-plugin · Note