GHSA-cc55-c9j4-m7cx

Jenkins allows Cross-Site Scripting (XSS)

En bref

Publiée: 2022-05-04 00:29 UTC
Mise à jour: 2025-03-13 18:40 UTC
CVE: CVE-2012-0325
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Description

Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0324.

Paquets affectés

Paquet	Versions
Maven · org.jenkins-ci.main:jenkins-core	introduced 1.425, fixed 1.454
Maven · org.jenkins-ci.main:jenkins-core	introduced 0, fixed 1.424.5

Références

https://nvd.nist.gov/vuln/detail/CVE-2012-0325 ADVISORY
https://github.com/jenkinsci/jenkins PACKAGE
https://web.archive.org/web/20200229025003/http://www.securityfocus.com/bid/52384 WEB
http://jvn.jp/en/jp/JVN79950061/index.html WEB
http://jvndb.jvn.jp/jvndb/JVNDB-2012-000023 WEB
http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-03-05.cb WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database