PT-2018-9459 · Jenkins · Jenkins Badge Plugin+1

Published 2018-06-26 · Updated 2022-05-14 · CVE-2018-1000604

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Badge Plugin versions 1.4 and earlier

Description A persisted cross-site scripting issue exists in the Jenkins Badge Plugin, specifically in BadgeSummaryAction.java and HtmlBadgeAction.java, allowing attackers who can control build badge content to define JavaScript that would be executed in another user's browser when that user performs certain UI actions.

Recommendations For Jenkins Badge Plugin versions 1.4 and earlier, update to version 1.5 or newer, which sanitizes the provided HTML for display on the Jenkins web UI.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-1000604

GHSA-3XJQ-8J89-XRW9

Affected Products

Jenkins

Jenkins Badge Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000604 · Security Note
• https://jenkins.io/security/advisory/2018-06-25/#SECURITY-906 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3xjq-8j89-xrw9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000604 · Vendor Advisory
• https://github.com/jenkinsci/badge-plugin · Note
• https://github.com/jenkinsci/badge-plugin/commit/63a7744cef33338e62898576a50bcc521d76ba9f · Note