Description

A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.

Remediation

References

http://packetstormsecurity.com/files/153610/Jenkins-Dependency-Graph-View-0.13-Cross-Site-Scripting.html

http://www.openwall.com/lists/oss-security/2019/07/11/4

http://www.securityfocus.com/bid/109156

https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1177

Related Vulnerabilities

CVE-2023-36470 Vulnerability in maven package org.xwiki.platform:xwiki-platform-icon-ui

CVE-2015-8031 Vulnerability in maven package org.jvnet.hudson.main:hudson-core

CVE-2018-14042 Vulnerability in maven package org.webjars.bowergithub.jasny:bootstrap

CVE-2022-0235 Vulnerability in npm package node-fetch

CVE-2022-25927 Vulnerability in maven package org.webjars.bowergithub.faisalman:ua-parser-js

Severity

Medium

Classification

CWE-79 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Exploit Third Party Advisory VDB Entry Mailing List Broken Link Vendor Advisory