Описание
Content-Security-Policy disabled by Red Hat Dependency Analytics Jenkins Plugin
Jenkins sets the Content-Security-Policy header to static files served by Jenkins (specifically DirectoryBrowserSupport), such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified.
Red Hat Dependency Analytics Plugin 0.7.1 and earlier globally disables the Content-Security-Policy header for static files served by Jenkins whenever the 'Invoke Red Hat Dependency Analytics (RHDA)' build step is executed. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.
Пакеты
io.jenkins.plugins:redhat-dependency-analytics
< 0.9.0
0.9.0
Связанные уязвимости
Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
Уязвимость плагина Jenkins Red Hat Dependency Analytics, связанная с неправильной нейтрализация ввода во время создания веб-страницы, позволяющая нарушителю осуществлять атаки с использованием межсайтовых сценариев (XSS) с возможностью управления файлами в рабочих областях
