GHSA-fxj8-cqcp-3vgq

Jenkins cross-site scripting (XSS) vulnerability

At a glance

Published: 2022-05-17 03:53 UTC
Updated: 2024-12-03 06:08 UTC
CVE: CVE-2014-2065

Description

Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie.

Affected packages

Package	Versions
Maven · org.jenkins-ci.main:jenkins-core	introduced 1.533, fixed 1.551
Maven · org.jenkins-ci.main:jenkins-core	introduced 0, fixed 1.532.2

References

https://nvd.nist.gov/vuln/detail/CVE-2014-2065 ADVISORY
https://github.com/jenkinsci/jenkins/commit/a0b00508eeb74d7033dc4100eb382df4e8fa72e7 WEB
https://github.com/jenkinsci/jenkins PACKAGE
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 WEB
http://www.openwall.com/lists/oss-security/2014/02/21/2 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database