PT-2019-8737 · Jenkins · Jenkins Git Changelog Plugin+1

Daniel Beck · Published 2019-01-09 · Updated 2022-05-13 · CVE-2018-1000426

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Git Changelog Plugin versions 2.6 and earlier

Description A cross-site scripting issue exists that allows attackers to control the Git history parsed by the plugin, enabling them to have Jenkins render arbitrary HTML on some pages. This occurs in files such as GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, and GitLogBasicChangelogPostPublisher/config.jelly.

Recommendations For Jenkins Git Changelog Plugin versions 2.6 and earlier, consider disabling the plugin until a patch is available to prevent exploitation. Restrict access to the plugin's functionality to minimize the risk of arbitrary HTML rendering. Avoid using the plugin to parse untrusted Git history until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-1000426

GHSA-JCMG-9RW5-9RM2

Affected Products

Jenkins

Jenkins Git Changelog Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000426 · Security Note
• https://osv.dev/vulnerability/GHSA-jcmg-9rw5-9rm2 · Vendor Advisory
• https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1122 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000426 · Vendor Advisory
• http://securityfocus.com/bid/106532 · Note