Описание
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.
A flaw was found in Jenkins in versions prior to 2.251 and LTS 2.235.3. Tooltip values, which are not properly escaped, can be contributed by plugins and use user-specified values. This results in a potential stored cross-site scripting (XSS) vulnerability. This highest threat from this vulnerability is to data confidentiality and integrity.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Fuse 7 | jenkins | Not affected | ||
| Red Hat OpenShift Container Platform 3.11 | jenkins | Fixed | RHSA-2020:4223 | 22.10.2020 |
| Red Hat OpenShift Container Platform 4.3 | jenkins | Fixed | RHSA-2020:3808 | 23.09.2020 |
| Red Hat OpenShift Container Platform 4.4 | openshift4/ose-jenkins | Fixed | RHSA-2020:4220 | 13.10.2020 |
| Red Hat OpenShift Container Platform 4.5 | jenkins | Fixed | RHSA-2020:3841 | 30.09.2020 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS3
Связанные уязвимости
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the ...
Jenkins Cross-Site Scripting vulnerability in help icons
EPSS
5.4 Medium
CVSS3