Jenkins Groovy Postbuild Plugin vulnerable to Cross-site Scripting

MEDIO 5.4CVE-2018-1000202 · GHSA-38ch-x695-m794 · Published 05/06/2018 · updated 17/06/2026

En resumen

CVE-2018-1000202 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a org.jvnet.hudson.plugins:groovy-postbuild, groovy postbuild (jenkins).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.72%, mayor que el 54.1% de las vulnerabilidades.
Solución: actualizar a 2.4 o posterior.

Package	Affected versions	Patched versions
org.jvnet.hudson.plugins:groovy-postbuild Maven	`< 2.4`	`2.4`
groovy postbuild jenkins	`≤ 2.3.1`	No fix yet

Description

A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2018-1000202 · ADVISORY
jenkins.io/security/advisory/2018-05-09 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free