Описание
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
Ссылки
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
9.6 Critical
CVSS3
Дефекты
Связанные уязвимости
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.37 ...
Уязвимость сервера автоматизации Jenkins, связанная с ошибками обработки HTTP-заголовков, позволяющая нарушителю осуществлять межсайтовые сценарные атаки (XSS)
EPSS
9.6 Critical
CVSS3