GHSA-7m8v-w6f9-q2f9MediumCVSS 5.4

Cross-site Scripting in Jenkins Rebuilder Plugin

Published
May 14, 2022
Last Modified
December 6, 2023

🔗 CVE IDs covered (1)

CVE-2018-1000415 →

📋 Description

A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in

RebuildAction/BooleanParameterValue.jelly,  
RebuildAction/ExtendedChoiceParameterValue.jelly,  
RebuildAction/FileParameterValue.jelly,  
RebuildAction/LabelParameterValue.jelly,  
RebuildAction/ListSubversionTagsParameterValue.jelly,  
RebuildAction/MavenMetadataParameterValue.jelly,  
RebuildAction/NodeParameterValue.jelly,  
RebuildAction/PasswordParameterValue.jelly,  
RebuildAction/RandomStringParameterValue.jelly,  
RebuildAction/RunParameterValue.jelly,  
RebuildAction/StringParameterValue.jelly,  
RebuildAction/TextParameterValue.jelly,  
RebuildAction/ValidatingStringParameterValue.jelly

that allows users with Job/Configuration permission to insert arbitrary HTML into rebuild forms.

🎯 Affected products1

  • maven/com.sonyericsson.hudson.plugins.rebuild:rebuild:< 1.29

🔗 References (5)