GitHub Advisoryadvisory · Maven

GHSA-7m8v-w6f9-q2f9 Cross-site Scripting in Jenkins Rebuilder Plugin

MEDIUM Published 2022-05-14 Modified 2022-11-03 Official page ↗
Aliases
CVE-2018-1000415
Ecosystem
Maven
Packages
com.sonyericsson.hudson.plugins.rebuild:rebuild
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-11-03

Affected packages

• Maven com.sonyericsson.hudson.plugins.rebuild:rebuild: < 1.29 → fixed in 1.29

Description

A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in ``` RebuildAction/BooleanParameterValue.jelly, RebuildAction/ExtendedChoiceParameterValue.jelly, RebuildAction/FileParameterValue.jelly, RebuildAction/LabelParameterValue.jelly, RebuildAction/ListSubversionTagsParameterValue.jelly, RebuildAction/MavenMetadataParameterValue.jelly, RebuildAction/NodeParameterValue.jelly, RebuildAction/PasswordParameterValue.jelly, RebuildAction/RandomStringParameterValue.jelly, RebuildAction/RunParameterValue.jelly, RebuildAction/StringParameterValue.jelly, RebuildAction/TextParameterValue.jelly, RebuildAction/ValidatingStringParameterValue.jelly ``` that allows users with Job/Configuration permission to insert arbitrary HTML into rebuild forms.

Related

Alias · CVE (1)

  • CVE-2018-1000415 A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in RebuildAction/BooleanParameterValue.jelly,… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References