What is GHSA-v9rw-hjr3-426h?

GHSA-v9rw-hjr3-426h is a security advisory published by GitHub Security Advisories with High severity. Jenkins Docker Swarm Plugin stored cross-site scripting vulnerability

Which CVE IDs does GHSA-v9rw-hjr3-426h cover?

GHSA-v9rw-hjr3-426h covers the following CVE IDs: CVE-2023-40350. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v9rw-hjr3-426h?

GHSA-v9rw-hjr3-426h has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-v9rw-hjr3-426h?

GHSA-v9rw-hjr3-426h affects 1 product, including: maven/org.jenkins-ci.plugins:docker-swarm:\u003c= 1.11.

GHSA-v9rw-hjr3-426hHighCVSS 7.5

Jenkins Docker Swarm Plugin stored cross-site scripting vulnerability

Vendor

GitHub Security Advisories

Published

August 16, 2023

Last Modified

November 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-40350 →

📋 Description

Jenkins Docker Swarm Plugin processes Docker responses to generate the Docker Swarm Dashboard view.

Docker Swarm Plugin 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboard view. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control responses from Docker.

As of publication of this advisory, there is no fix.

🎯 Affected products1

maven/org.jenkins-ci.plugins:docker-swarm:<= 1.11

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-40350
https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2811
http://www.openwall.com/lists/oss-security/2023/08/16/3
https://github.com/advisories/GHSA-v9rw-hjr3-426h