GitHub Advisoryadvisory · Maven

GHSA-wqjj-c9cx-q7cf Jenkins Lockable Resources Plugin XSS vulnerability

MEDIUM Published 2022-05-13 Modified 2024-01-09 Official page ↗
Aliases
CVE-2019-1003042
Ecosystem
Maven
Packages
org.6wind.jenkins:lockable-resources
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-01-09

Affected packages

• Maven org.6wind.jenkins:lockable-resources: < 2.5 → fixed in 2.5

Description

A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.

Related

Alias · CVE (1)

  • CVE-2019-1003042 A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References