What is GHSA-3892-qqv6-h2qm?

GHSA-3892-qqv6-h2qm is a security advisory published by GitHub Security Advisories with Medium severity. Stored XSS vulnerability in Jenkins S3 Publisher Plugin

Which CVE IDs does GHSA-3892-qqv6-h2qm cover?

GHSA-3892-qqv6-h2qm covers the following CVE IDs: CVE-2018-1000177. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3892-qqv6-h2qm?

GHSA-3892-qqv6-h2qm has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-3892-qqv6-h2qm?

GHSA-3892-qqv6-h2qm affects 1 product, including: maven/org.jenkins-ci.plugins:s3:\u003c= 0.10.12.

GHSA-3892-qqv6-h2qmMediumCVSS 5.4

Stored XSS vulnerability in Jenkins S3 Publisher Plugin

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

January 30, 2024

🔗 CVE IDs covered (1)

CVE-2018-1000177 →

📋 Description

A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containing JavaScript that would be executed in another user's browser when that user performs some UI actions.

🎯 Affected products1

maven/org.jenkins-ci.plugins:s3:<= 0.10.12

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000177
https://jenkins.io/security/advisory/2018-04-16/
https://github.com/advisories/GHSA-3892-qqv6-h2qm