https://bugzilla.redhat.com/show_bug.cgi?id=1516791
Bug ID: 1516791
Summary: CVE-2017-1000392 jenkins: Persisted XSS vulnerability
in autocompletion suggestions
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: anemec(a)redhat.com
CC: bleanhar(a)redhat.com, ccoleman(a)redhat.com,
dedgar(a)redhat.com, dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jkeck(a)redhat.com,
kseifried(a)redhat.com, mizdebsk(a)redhat.com,
msrb(a)redhat.com
Autocompletion suggestions for text fields were not escaped, resulting in a
persisted cross-site scripting vulnerability if the source for the suggestions
allowed specifying text that includes HTML metacharacters like less-than and
greater-than characters.
Known previously unsafe sources for these suggestions include the names of
loggers in the log recorder condition, and agent labels.
External References:
https://jenkins.io/security/advisory/2017-11-08/
--
You are receiving this mail because:
You are on the CC list for the bug.