GitHub Advisoryadvisory · Maven

GHSA-x3p3-929j-pq66 Improper Neutralization of Input During Web Page Generation in Jenkins

MEDIUM Published 2022-05-17 Modified 2024-03-13 Official page ↗
Aliases
CVE-2015-7536
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-07-06

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 1.626, < 1.640 → fixed in 1.640 • Maven org.jenkins-ci.main:jenkins-core: < 1.625.2 → fixed in 1.625.2

Description

Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts.

Related

Alias · CVE (1)

  • CVE-2015-7536 Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References