GitHub Advisoryadvisory · Maven

GHSA-3892-qqv6-h2qm Stored XSS vulnerability in Jenkins S3 Publisher Plugin

MEDIUM Published 2022-05-14 Modified 2024-01-30 Official page ↗
Aliases
CVE-2018-1000177
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:s3
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-01-30

Affected packages

• Maven org.jenkins-ci.plugins:s3: < 0.11.0 → fixed in 0.11.0

Description

A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containing JavaScript that would be executed in another user's browser when that user performs some UI actions.

Related

Alias · CVE (1)

  • CVE-2018-1000177 A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References