A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.
References
Link | Resource |
---|---|
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-906 | Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2022-10-03T16:21:59
Updated: 2022-10-03T16:21:59
Reserved: 2018-06-25T00:00:00
Link: CVE-2018-1000604
JSON object: View
NVD Information
Status : Analyzed
Published: 2018-06-26T17:29:00.443
Modified: 2018-08-23T16:41:59.263
Link: CVE-2018-1000604
JSON object: View
Redhat Information
No data.
CWE