Описание
Jenkins Lockable Resources Plugin XSS vulnerability
A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2019-1003042
- https://github.com/jenkinsci/lockable-resources-plugin/commit/4f401e250eb9e865e951b069255fea7052423739
- https://access.redhat.com/errata/RHSA-2019:1423
- https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1361
- http://www.openwall.com/lists/oss-security/2019/03/28/2
- http://www.securityfocus.com/bid/107628
Пакеты
org.6wind.jenkins:lockable-resources
<= 2.4
2.5
Связанные уязвимости
A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.
A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.
Уязвимость плагина Jenkins Lockable Resources, существующая из-за непринятия мер по защите структуры веб-страницы, позволяющая нарушителю внедрять произвольный JavaScript-код в загружаемые веб-страницы