Описание
A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Container Platform 3.10 | jenkins | Will not fix | ||
| Red Hat OpenShift Container Platform 3.4 | jenkins | Will not fix | ||
| Red Hat OpenShift Container Platform 3.5 | jenkins | Will not fix | ||
| Red Hat OpenShift Container Platform 3.6 | jenkins | Will not fix | ||
| Red Hat OpenShift Container Platform 3.7 | jenkins | Will not fix | ||
| Red Hat OpenShift Container Platform 3.9 | jenkins | Will not fix | ||
| Red Hat OpenShift Container Platform 4 | jenkins | Not affected | ||
| Red Hat OpenShift Container Platform 3.11 | atomic-enterprise-service-catalog | Fixed | RHBA-2018:3743 | 12.12.2018 |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift | Fixed | RHBA-2018:3743 | 12.12.2018 |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift-cluster-autoscaler | Fixed | RHBA-2018:3743 | 12.12.2018 |
Показывать по
10
Дополнительная информация
Статус:
Moderate
Дефект:
CWE-79
https://bugzilla.redhat.com/show_bug.cgi?id=1642879jenkins: Reflected XSS vulnerability
EPSS
Процентиль: 72%
0.01534
Низкий
6.5 Medium
CVSS3
Связанные уязвимости
CVSS3: 6.1
nvd
больше 7 лет назад
A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins.
CVSS3: 6.1
debian
больше 7 лет назад
A cross-site scripting vulnerability exists in Jenkins 2.145 and earli ...
EPSS
Процентиль: 72%
0.01534
Низкий
6.5 Medium
CVSS3