Описание
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter.
A flaw was found in Jenkins weekly and LTS, which are vulnerable to cross-site scripting caused by improper validation of user-supplied input by the caption constructor parameter of ExpandableDetailsNote. This issue could allow a remote, authenticated attacker to inject malicious script into a Web page, which would be executed in a victim's Web browser in the hosting Web site, and then steal the victim's cookie-based authentication credentials.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | jenkins | Affected | ||
| Red Hat OpenShift Container Platform 3.11 | jenkins | Out of support scope | ||
| Red Hat OpenShift Container Platform 4 | jenkins | Affected |
Показывать по
Дополнительная информация
Статус:
5.4 Medium
CVSS3
Связанные уязвимости
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter.
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the ...
Уязвимость сервера автоматизации Jenkins, связанная с неправильной нейтрализация ввода во время создания веб-страницы, позволяющая нарушителю осуществлять атаки с использованием межсайтовых сценариев (XSS) с возможностью управления файлами в рабочих областях
5.4 Medium
CVSS3