Description

Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web script or HTML by leveraging failure to filter tool tips through the configured markup formatter.

Remediation

References

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-04-11

Related Vulnerabilities

CVE-2013-4330 Vulnerability in maven package org.apache.camel:camel-core

CVE-2023-32984 Vulnerability in maven package org.jenkins-ci.plugins:testng-plugin

CVE-2022-43405 Vulnerability in maven package io.jenkins.plugins:pipeline-groovy-lib

CVE-2012-5887 Vulnerability in maven package tomcat:catalina

CVE-2023-25653 Vulnerability in npm package node-jose

Severity

Medium

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Vendor Advisory