A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arbitrary attacker-specified HTML in Jenkins to users with Job/Configure access.
References
Link | Resource |
---|---|
http://www.securityfocus.com/bid/106532 | Third Party Advisory VDB Entry |
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1130 | Third Party Advisory |
Configurations
History
No history.
Information
Published : 2019-01-09 23:29
Updated : 2023-12-10 12:44
NVD link : CVE-2018-1000416
Mitre link : CVE-2018-1000416
CVE.ORG link : CVE-2018-1000416
JSON object : View
Products Affected
jobconfighistory_project
- jobconfighistory
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')