Описание
In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Ссылки
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 2.340 (включая) до 2.355 (включая)
cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
EPSS
Процентиль: 94%
0.11821
Средний
5.4 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79
Связанные уязвимости
CVSS3: 6.1
redhat
больше 3 лет назад
In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
CVSS3: 5.4
debian
больше 3 лет назад
In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the bui ...
EPSS
Процентиль: 94%
0.11821
Средний
5.4 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-79