PoC_CVE-2024-28157

PoC CVE-2024-28157 概述 Jenkins GitBucket 插件 0.8 及更早版本未对构建视图中的 Gitbucket URL 进行清理，导致存在存储型跨站脚本 XSS 漏洞，能够配置作业的攻击者可利用此漏洞。 利用步骤 设置 Jenkins（使用 Docker）： 1. 使用 Docker 运行 Jenkins 镜像。 root@kitploit: docker run jenkins/jenkins:lts 2. 通过 GUI 安装 Gitbucket 插件（该插件的最新版本为 0.8，存在漏洞，因此利用将生效）。 利用： 1...

Cross-site Scripting (XSS)

Jenkins iceScrum Plugin is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the lack of sanitization of iceScrum project URLs on build views. An attacker can inject malicious scripts if they are able to configure jobs...

Cross Site Scripting

org.jenkins-ci.plugins:gitbucket is vulnerable to Cross Site Scripting. The vulnerability is due to inadequate sanitization of GitBucket URLs on build views, allowing attackers with job configuration access to exploit it...

GHSA-2PC2-H97H-2MMW Jenkins iceScrum Plugin vulnerable to stored Cross-site Scripting

Jenkins iceScrum Plugin 1.1.6 and earlier does not sanitize iceScrum project URLs on build views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

GHSA-5J74-G3C5-WQWW Jenkins GitBucket Plugin vulnerable to stored Cross-site Scripting

Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

CVE-2024-28157

Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

Jenkins iceScrum Plugin Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability ...