Описание
A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins.
Ссылки
- Third Party AdvisoryVDB Entry
- Third Party Advisory
- Third Party AdvisoryVDB Entry
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.1 (включая)
cpe:2.3:a:jenkins:config_file_provider:*:*:*:*:*:jenkins:*:*
EPSS
Процентиль: 23%
0.00077
Низкий
5.4 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 5.4
github
больше 3 лет назад
Stored XSS vulnerability in Config File Provider Plugin
EPSS
Процентиль: 23%
0.00077
Низкий
5.4 Medium
CVSS3
3.5 Low
CVSS2
Дефекты
CWE-79