CVE-2015-5326

2015-11-2520:59:18

CWE-79

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

39.8%

JSON

Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message.

Affected configurations

Nvd

Node

jenkinsjenkinsRange≤1.637

Node

redhatopenshiftRange≤3.1enterprise

Node

redhatopenshiftMatch2.0

Node

jenkinsjenkinsRange≤1.625.1lts

VendorProductVersionCPE
jenkinsjenkins*cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*
redhatopenshift*cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:*
redhatopenshift2.0cpe:2.3:a:redhat:openshift:2.0:*:*:*:*:*:*:*
jenkinsjenkins*cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*

Vendor	Product	Version	CPE
jenkins	jenkins	*	cpe:2.3:a:jenkins:jenkins::::::::
redhat	openshift	*	cpe:2.3:a:redhat:openshift:::::enterprise:::*
redhat	openshift	2.0	cpe:2.3:a:redhat:openshift:2.0:::::::*
jenkins	jenkins	*	cpe:2.3:a:jenkins:jenkins:::::lts:::*