What is GHSA-x3p3-929j-pq66?

GHSA-x3p3-929j-pq66 is a security advisory published by GitHub Security Advisories with Medium severity. Improper Neutralization of Input During Web Page Generation in Jenkins

Which CVE IDs does GHSA-x3p3-929j-pq66 cover?

GHSA-x3p3-929j-pq66 covers the following CVE IDs: CVE-2015-7536. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x3p3-929j-pq66?

GHSA-x3p3-929j-pq66 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-x3p3-929j-pq66?

GHSA-x3p3-929j-pq66 affects 2 products, including: maven/org.jenkins-ci.main:jenkins-core:\u003e= 1.626, \u003c 1.640; maven/org.jenkins-ci.main:jenkins-core:\u003c 1.625.2.

GHSA-x3p3-929j-pq66MediumCVSS 5.4

Improper Neutralization of Input During Web Page Generation in Jenkins

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

March 23, 2024

🔗 CVE IDs covered (1)

CVE-2015-7536 →

📋 Description

Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts.

🎯 Affected products2

maven/org.jenkins-ci.main:jenkins-core:>= 1.626, < 1.640
maven/org.jenkins-ci.main:jenkins-core:< 1.625.2

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2015-7536
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-12-09
https://github.com/jenkinsci/jenkins/commit/27c303417a226bf4c06a588570f28ac2e2507c6c
https://github.com/jenkinsci/jenkins/commit/d3fb2c09f29007dce84a213ae8323df1105dcc30
https://github.com/advisories/GHSA-x3p3-929j-pq66