CVE-2017-1000404

Опубликовано: 26 янв. 2018

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScript, resulting in a cross-site scripting vulnerability through specially crafted URLs.

Ссылки

http://www.securityfocus.com/bid/101927
Third Party Advisory
VDB Entry
https://jenkins.io/security/advisory/2017-11-16/
Vendor Advisory
http://www.securityfocus.com/bid/101927
Third Party Advisory
VDB Entry
https://jenkins.io/security/advisory/2017-11-16/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:delivery_pipeline:*:*:*:*:*:jenkins:*:*

Версия до 1.0.7 (включая)

EPSS

Процентиль: 17%

0.00054

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-g364-c7w5-93wh