Описание
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.
A flaw was found in Jenkins versions prior to 2.251 and LTS 2.235.3. The remote address of hosts starting a build via 'Trigger builds remotely' are not properly escaped leading to a potential stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the authentication token. The highest threat from this vulnerability is to data confidentiality and integrity.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Fuse 7 | jenkins | Not affected | ||
| Red Hat OpenShift Container Platform 3.11 | jenkins | Fixed | RHSA-2020:4223 | 22.10.2020 |
| Red Hat OpenShift Container Platform 4.3 | jenkins | Fixed | RHSA-2020:3808 | 23.09.2020 |
| Red Hat OpenShift Container Platform 4.4 | openshift4/ose-jenkins | Fixed | RHSA-2020:4220 | 13.10.2020 |
| Red Hat OpenShift Container Platform 4.5 | jenkins | Fixed | RHSA-2020:3841 | 30.09.2020 |
Показывать по
Дополнительная информация
Статус:
EPSS
5.4 Medium
CVSS3
Связанные уязвимости
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the ...
Improper Neutralization of Input During Web Page Generation in Jenkins
EPSS
5.4 Medium
CVSS3