CVE-2018-1999029

2018-08-0113:29:00

Google

osv.dev

5.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.2%

JSON

A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjectsAction/index.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user’s browser when that other user performs some UI actions.

CPENameOperatorVersion
shelve-project-plugineqshelve-project-plugin-1.4.4
shelve-project-plugineqshelve-project-plugin-1.2
shelve-project-plugineqshelve-project-plugin-1.5
shelve-project-plugineq1.4-release
shelve-project-plugineqshelve-project-plugin-1.3

Name	Operator	Version
shelve-project-plugin	eq	shelve-project-plugin-1.4.4
shelve-project-plugin	eq	shelve-project-plugin-1.2
shelve-project-plugin	eq	shelve-project-plugin-1.5
shelve-project-plugin	eq	1.4-release
shelve-project-plugin	eq	shelve-project-plugin-1.3

References

jenkins.io/security/advisory/2018-07-30/#SECURITY-1001