https://bugzilla.redhat.com/show_bug.cgi?id=1291794
Bug ID: 1291794
Summary: CVE-2015-7536 jenkins: stored XSS vulnerability
through workspace files and archived artifacts
(SECURITY-95)
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mprpic(a)redhat.com
CC: abhgupta(a)redhat.com, ccoleman(a)redhat.com,
dmcphers(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jialiu(a)redhat.com, joelsmith(a)redhat.com,
jokerman(a)redhat.com, kseifried(a)redhat.com,
lmeyer(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com,
tiwillia(a)redhat.com
In certain configurations, low privilege users were able to create e.g. HTML
files in workspaces and archived artifacts that could result in XSS when
accessed by other users. Jenkins now sends Content-Security-Policy headers that
enables sandboxing and prohibits script execution by default.
This could allow low-privilege users to perform limited XSS in certain
configurations.
External References:
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+20...
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=BQv8HX1t7u&a=cc_unsubscribe