Описание
In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability.
Отчет
This vulnerability affects the Jenkins 2.340 through 2.355 (both inclusive). Red Hat products use Jenkins version 2.319 which is NOT affected by this vulnerability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | jenkins | Not affected | ||
| Red Hat OpenShift Container Platform 4 | jenkins | Not affected |
Показывать по
10
Дополнительная информация
Статус:
Moderate
Дефект:
CWE-79
https://bugzilla.redhat.com/show_bug.cgi?id=2119650Jenkins: Cross-site scripting (XSS) vulnerability in Jenkins LTS
EPSS
Процентиль: 68%
0.01351
Низкий
6.1 Medium
CVSS3
Связанные уязвимости
CVSS3: 5.4
nvd
около 4 лет назад
In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability.
CVSS3: 5.4
debian
около 4 лет назад
In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons une ...
EPSS
Процентиль: 68%
0.01351
Низкий
6.1 Medium
CVSS3