What is GHSA-vwfm-42q6-qj75?

GHSA-vwfm-42q6-qj75 is a security advisory published by GitHub Security Advisories with Medium severity. Stored XSS vulnerability in Config File Provider Plugin

Which CVE IDs does GHSA-vwfm-42q6-qj75 cover?

GHSA-vwfm-42q6-qj75 covers the following CVE IDs: CVE-2018-1000413. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vwfm-42q6-qj75?

GHSA-vwfm-42q6-qj75 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-vwfm-42q6-qj75?

GHSA-vwfm-42q6-qj75 affects 1 product, including: maven/org.jenkins-ci.plugins:config-file-provider:\u003c= 3.1.

GHSA-vwfm-42q6-qj75MediumCVSS 5.4

Stored XSS vulnerability in Config File Provider Plugin

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

December 15, 2023

🔗 CVE IDs covered (1)

CVE-2018-1000413 →

📋 Description

A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins.

🎯 Affected products1

maven/org.jenkins-ci.plugins:config-file-provider:<= 3.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000413
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1080
http://www.securityfocus.com/bid/106532
https://github.com/jenkinsci/config-file-provider-plugin/commit/5c1df554e44b712e5d926b8d5557c592bf9f0a33
https://github.com/advisories/GHSA-vwfm-42q6-qj75