Опубликовано: 27 нояб. 2024
Источник: github
Github: Прошло ревью
CVSS4: 8.6
CVSS3: 8
Описание
Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability
Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.
Simple Queue Plugin 1.4.5 escapes the view name.
Пакеты
Наименование
io.jenkins.plugins:simple-queue
maven
Затронутые версииВерсия исправления
< 1.4.5
1.4.5
Связанные уязвимости
CVSS3: 8
nvd
около 1 года назад
Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.