Jenkins < 2.107.2 / 2.116 Multiple Vulnerabilities

The version of Jenkins running on the remote web server is prior to 2.116 or is a version of Jenkins LTS prior to 2.107.2. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported versio...

CVE-2018-1000170

CVE-2018-1000170 is a cross-site scripting vulnerability in Jenkins, affecting 2.115 and older (including LTS 2.107.1 and older). The issue resides in confirmationList.jelly and stopButton.jelly, where an attacker with Job/Configure and/or Job/Create permissions can create an item name containing...