What is GHSA-wqjj-c9cx-q7cf?

GHSA-wqjj-c9cx-q7cf is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins Lockable Resources Plugin XSS vulnerability

Which CVE IDs does GHSA-wqjj-c9cx-q7cf cover?

GHSA-wqjj-c9cx-q7cf covers the following CVE IDs: CVE-2019-1003042. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wqjj-c9cx-q7cf?

GHSA-wqjj-c9cx-q7cf has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-wqjj-c9cx-q7cf?

GHSA-wqjj-c9cx-q7cf affects 1 product, including: maven/org.6wind.jenkins:lockable-resources:\u003c= 2.4.

GHSA-wqjj-c9cx-q7cfMediumCVSS 5.4

Jenkins Lockable Resources Plugin XSS vulnerability

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

January 9, 2024

🔗 CVE IDs covered (1)

CVE-2019-1003042 →

📋 Description

A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.

🎯 Affected products1

maven/org.6wind.jenkins:lockable-resources:<= 2.4

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2019-1003042
https://access.redhat.com/errata/RHSA-2019:1423
https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1361
http://www.openwall.com/lists/oss-security/2019/03/28/2
http://www.securityfocus.com/bid/107628
https://github.com/jenkinsci/lockable-resources-plugin/commit/4f401e250eb9e865e951b069255fea7052423739
https://github.com/advisories/GHSA-wqjj-c9cx-q7cf