En bref
- CVE-2018-1000415 est une vulnérabilité MOYENNE (CVSS 5.4) touchant com.sonyericsson.hudson.plugins.rebuild:rebuild, rebuild (rebuild project).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.62%, plus élevée que 49.9% des vulnérabilités.
- Correctif : mettre à jour vers 1.29 ou plus récent.
Description
A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in
RebuildAction/BooleanParameterValue.jelly,
RebuildAction/ExtendedChoiceParameterValue.jelly,
RebuildAction/FileParameterValue.jelly,
RebuildAction/LabelParameterValue.jelly,
RebuildAction/ListSubversionTagsParameterValue.jelly,
RebuildAction/MavenMetadataParameterValue.jelly,
RebuildAction/NodeParameterValue.jelly,
RebuildAction/PasswordParameterValue.jelly,
RebuildAction/RandomStringParameterValue.jelly,
RebuildAction/RunParameterValue.jelly,
RebuildAction/StringParameterValue.jelly,
RebuildAction/TextParameterValue.jelly,
RebuildAction/ValidatingStringParameterValue.jelly
that allows users with Job/Configuration permission to insert arbitrary HTML into rebuild forms.
NVD description
A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in RebuildAction/BooleanParameterValue.jelly, RebuildAction/ExtendedChoiceParameterValue.jelly, RebuildAction/FileParameterValue.jelly, RebuildAction/LabelParameterValue.jelly, RebuildAction/ListSubversionTagsParameterValue.jelly, RebuildAction/MavenMetadataParameterValue.jelly, RebuildAction/NodeParameterValue.jelly, RebuildAction/PasswordParameterValue.jelly, RebuildAction/RandomStringParameterValue.jelly, RebuildAction/RunParameterValue.jelly, RebuildAction/StringParameterValue.jelly, RebuildAction/TextParameterValue.jelly, RebuildAction/ValidatingStringParameterValue.jelly that allows users with Job/Configuration permission to insert arbitrary HTML into rebuild forms.
Autres vulnérabilités de com.sonyericsson.hudson.plugins.rebuild:rebuild
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free