PT-2019-8724 · Jenkins · Jenkins Config File Provider Plugin+1

Daniel Beck · Published 2019-01-09 · Updated 2023-01-31 · CVE-2018-1000413

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Config File Provider Plugin versions 3.1 and earlier

Description A cross-site scripting issue exists in the configfiles.jelly and providerlist.jelly files, allowing users who can configure configuration files to insert arbitrary HTML into some Jenkins pages.

Recommendations For Jenkins Config File Provider Plugin versions 3.1 and earlier, update to a version later than 3.1 to resolve the issue. As a temporary workaround, consider restricting access to the configfiles.jelly and providerlist.jelly files to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-1000413

GHSA-VWFM-42Q6-QJ75

Affected Products

Jenkins

Jenkins Config File Provider Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000413 · Security Note
• https://osv.dev/vulnerability/GHSA-vwfm-42q6-qj75 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000413 · Vendor Advisory
• https://github.com/jenkinsci/config-file-provider-plugin/commit/5c1df554e44b712e5d926b8d5557c592bf9f0a33 · Note
• https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1080 · Note
• https://t.me/cvenotify/43218 · Telegram Post
• http://securityfocus.com/bid/106532 · Note