PT-2018-9370 · Jenkins · Jenkins Groovy Postbuild Plugin+1

Published 2018-06-05 · Updated 2022-05-14 · CVE-2018-1000202

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Groovy Postbuild Plugin versions 2.3.1 and older

Description A persisted cross-site scripting issue exists in various Jelly files, allowing attackers who can control build badge content to define JavaScript that would be executed in another user's browser when that user performs certain UI actions.

Recommendations For versions 2.3.1 and older, update to a version newer than 2.3.1 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-1000202

GHSA-38CH-X695-M794

Affected Products

Jenkins

Jenkins Groovy Postbuild Plugin

References · 4

• https://jenkins.io/security/advisory/2018-05-09/#SECURITY-821 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000202 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000202 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-38ch-x695-m794 · Vendor Advisory