PT-2018-9340 · Cloudbees+1 · Jenkins

Jesper Den Boer · Published 2018-04-13 · Updated 2022-05-14 · CVE-2018-1000170

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.115 and older Jenkins LTS versions 2.107.1 and older

Description A cross-site scripting issue exists in confirmationList.jelly and stopButton.jelly, allowing attackers with Job/Configure and/or Job/Create permission to create an item name containing JavaScript. This JavaScript would be executed in another user's browser when that other user performs certain UI actions.

Recommendations For Jenkins versions 2.115 and older, update to a version newer than 2.115 to resolve the issue. For Jenkins LTS versions 2.107.1 and older, update to a version newer than 2.107.1 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-1000170

GHSA-9JCV-V4JP-W3CQ

Affected Products

Jenkins

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000170 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000170 · Vendor Advisory
• https://jenkins.io/security/advisory/2018-04-11/#SECURITY-759 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9jcv-v4jp-w3cq · Vendor Advisory
• https://github.com/jenkinsci/jenkins/commit/07d18cfd6d336a2b7cc0a78e120d9739a5d4e1d1 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000170 · Note