https://bugzilla.redhat.com/show_bug.cgi?id=1609620
Bug ID: 1609620
Summary: CVE-2018-1999005 jenkins: Cross-site scripting in
build timeline widget exploitable by users able to
control item display names
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: sfowler(a)redhat.com
CC: ahardin(a)redhat.com, aos-bugs(a)redhat.com,
bleanhar(a)redhat.com, bparees(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Blocks: 1609611
In Jenkins, the build timeline widget shown on URLs like /view/…/builds did not
properly escape display names of items. This resulted in a cross-site scripting
vulnerability exploitable by users able to control item display names.
External Reference:
https://jenkins.io/security/advisory/2018-07-18/#SECURITY-944
--
You are receiving this mail because:
You are on the CC list for the bug.