GHSA-fxj8-cqcp-3vgq

Jenkins cross-site scripting (XSS) vulnerability

En bref

Publiée: 2022-05-17 03:53 UTC
Mise à jour: 2024-12-03 06:08 UTC
CVE: CVE-2014-2065

Description

Cross-site scripting (XSS) vulnerability in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to inject arbitrary web script or HTML via the iconSize cookie.

Paquets affectés

Paquet	Versions
Maven · org.jenkins-ci.main:jenkins-core	introduced 1.533, fixed 1.551
Maven · org.jenkins-ci.main:jenkins-core	introduced 0, fixed 1.532.2

Références

https://nvd.nist.gov/vuln/detail/CVE-2014-2065 ADVISORY
https://github.com/jenkinsci/jenkins/commit/a0b00508eeb74d7033dc4100eb382df4e8fa72e7 WEB
https://github.com/jenkinsci/jenkins PACKAGE
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 WEB
http://www.openwall.com/lists/oss-security/2014/02/21/2 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database