PoC_CVE-2024-28157

PoC CVE-2024-28157 概要 Jenkins GitBucket プラグイン バージョン 0.8 以前では、ビューの構築時に Gitbucket の URL がサニタイズされず、ジョブを設定できる攻撃者が悪用可能な保存型 クロスサイトスクリプティング XSS の脆弱性が発生します。 悪用手順 Jenkins のセットアップ docker を使用: 1. docker を使用して jenkins イメージを実行します。 root@kitploit: docker run jenkins/jenkins:lts 2. GUI から Gitbucket プラグインをインストールし...

Cross-site Scripting (XSS)

Jenkins iceScrum Plugin is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the lack of sanitization of iceScrum project URLs on build views. An attacker can inject malicious scripts if they are able to configure jobs...

Cross Site Scripting

org.jenkins-ci.plugins:gitbucket is vulnerable to Cross Site Scripting. The vulnerability is due to inadequate sanitization of GitBucket URLs on build views, allowing attackers with job configuration access to exploit it...

GHSA-2PC2-H97H-2MMW Jenkins iceScrum Plugin vulnerable to stored Cross-site Scripting

Jenkins iceScrum Plugin 1.1.6 and earlier does not sanitize iceScrum project URLs on build views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

GHSA-5J74-G3C5-WQWW Jenkins GitBucket Plugin vulnerable to stored Cross-site Scripting

Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

CVE-2024-28157

Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

Stored XSS vulnerability in gitbucket

gitbucket 0.8 and earlier does not sanitize Gitbucket URLs on build views. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs. As of publication of this advisory, there is no fix. Learn why we announce this...

CVE-2024-28160: Improper Neutralization of Input During Web Page Generation

Jenkins iceScrum Plugin 1.1.6 and earlier does not sanitize iceScrum project URLs on build views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...

Jenkins iceScrum Plugin Security Vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability ...

CVE-2024-28157: Improper Neutralization of Input During Web Page Generation

Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs...