CVE-2018-1999007

Опубликовано: 23 июл. 2018

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers with the ability to control the existence of some URLs in Jenkins to define JavaScript that would be executed in another user's browser when that other user views HTTP 404 error pages while Stapler debug mode is enabled.

Ссылки

https://jenkins.io/security/advisory/2018-07-18/#SECURITY-390
Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://jenkins.io/security/advisory/2018-07-18/#SECURITY-390
Vendor Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*

Версия до 2.121.1 (включая)

cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*

Версия от 2.122 (включая) до 2.132 (включая)

Конфигурация 2

cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 37%

0.00158

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2018-1999007

CVSS3: 4.7

redhat

больше 7 лет назад

CVE-2018-1999007

CVSS3: 5.4

debian

больше 7 лет назад

A cross-site scripting vulnerability exists in Jenkins 2.132 and earli ...

GHSA-6456-xjm5-g3pg

CVSS3: 5.4

github

больше 3 лет назад

Cross-site scripting vulnerability exists in Jenkins and Stapler Plugin

EPSS

Процентиль: 37%

0.00158

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79