A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins.
References
Link | Resource |
---|---|
http://www.securityfocus.com/bid/106532 | Third Party Advisory VDB Entry |
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1080 | Third Party Advisory |
Configurations
History
31 Jan 2023, 20:15
Type | Values Removed | Values Added |
---|---|---|
First Time |
Jenkins config File Provider
Jenkins |
|
CPE | cpe:2.3:a:jenkins:config_file_provider:*:*:*:*:*:jenkins:*:* |
Information
Published : 2019-01-09 23:29
Updated : 2023-12-10 12:44
NVD link : CVE-2018-1000413
Mitre link : CVE-2018-1000413
CVE.ORG link : CVE-2018-1000413
JSON object : View
Products Affected
jenkins
- config_file_provider
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')