CVE-2017-1000389

CVE-2017-1000389 affects Jenkins global-build-stats plugin (v1.4 and earlier). The vulnerability arises from JSON responses served with Content-Type: text/html, allowing potential reflected XSS, and from some data-modifying URLs that did not require POST, enabling potential CSRF. The connected so...

CVE-2017-1000389

Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. These responses had the Content Type: text/html, so could have been interpreted as HTML by clients, resulting in a potential reflected cross-site scripting...

CVE-2017-1000389

Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. These responses had the Content Type: text/html, so could have been interpreted as HTML by clients, resulting in a potential reflected cross-site scripting...

PT-2018-5171

Name of the Vulnerable Software and Affected Versions Jenkins global-build-stats plugin version 1.4 and earlier Description The issue concerns reflected cross-site scripting and cross-site request forgery vulnerabilities. Some URLs provided by the plugin returned JSON responses containing request...

CVE-2017-1000389: Improper Neutralization of Input During Web Page Generation

Some URLs provided by Jenkins global-build-stats plugin version 1.4 and earlier returned a JSON response that contained request parameters. These responses had the Content Type: text/html, so could have been interpreted as HTML by clients, resulting in a potential reflected cross-site scripting...