Lucene search

Veracode Vulnerability DatabaseVERACODE:40711

HistoryMay 28, 2023 - 2:43 p.m.

Cross-site Scripting (XSS)

2023-05-2814:43:44

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.9 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

38.0%

JSON

workflow-job is vulnerable to Cross-site Scripting (XSS). The vulnerability exists because the displayName attribute of the summary.jelly does not escape before being rendered, allowing an attacker to inject and execute malicious JavaScript.

CPENameOperatorVersion
pipeline: joble1292.v27d8cc3e2602
pipeline: joble1292.v27d8cc3e2602
jenkins-2-pluginseq4.6.1643965689__1.el8
jenkins-2-pluginseq4.10.1675144701__1.el8
jenkins-2-pluginseq4.12.1675702407__1.el8
jenkins-2-pluginseq4.11.1661877421__1.el8
jenkins-2-pluginseq4.9.1630555871__1.el8
jenkins-2-pluginseq4.8.1633555500__1.el8
jenkins-2-pluginseq4.7.1616671397__1.el8
jenkins-2-pluginseq4.10.1663147786__1.el8

Name	Operator	Version
pipeline: job	le	1292.v27d8cc3e2602
pipeline: job	le	1292.v27d8cc3e2602
jenkins-2-plugins	eq	4.6.1643965689__1.el8
jenkins-2-plugins	eq	4.10.1675144701__1.el8
jenkins-2-plugins	eq	4.12.1675702407__1.el8
jenkins-2-plugins	eq	4.11.1661877421__1.el8
jenkins-2-plugins	eq	4.9.1630555871__1.el8
jenkins-2-plugins	eq	4.8.1633555500__1.el8
jenkins-2-plugins	eq	4.7.1616671397__1.el8
jenkins-2-plugins	eq	4.10.1663147786__1.el8

Rows per page:

1-10 of 651

References

github.com/advisories/GHSA-2wvv-phhw-qvmc

github.com/jenkinsci/workflow-job-plugin/commit/395eb740000509bff789c7f409c90f2a4a738821

www.jenkins.io/security/advisory/2023-05-16/#SECURITY-3042

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.9 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

38.0%

JSON

Related for VERACODE:40711