CVE-2012-6074: XSS
Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.
Other sources
Jenkins Security Advisory 2012-11-20
The third vulnerability is a cross-site scripting vulnerability that allows an attacker with some degree of write access in Jenkins to embed malicious JavaScript into pages generated by Jenkins.
Fix: Main line users should upgrade to Jenkins 1.491 LTS users should upgrade to 1.480.1
External URLs: https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-11-20 http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6074?
The severity of CVE-2012-6074 is classified as moderate, posing a cross-site scripting (XSS) risk to affected Jenkins versions.
How do I fix CVE-2012-6074?
To fix CVE-2012-6074, upgrade Jenkins to versions 1.491 or later, or the corresponding Jenkins LTS versions that address this vulnerability.
Which Jenkins versions are affected by CVE-2012-6074?
CVE-2012-6074 affects Jenkins versions before 1.491, Jenkins LTS before 1.480.1, and specific Jenkins Enterprise versions indicated in its details.
What are the potential impacts of CVE-2012-6074?
The potential impacts of CVE-2012-6074 include unauthorized script injection, which could lead to data exposure and session hijacking.
Is CVE-2012-6074 a remote exploitation vulnerability?
Yes, CVE-2012-6074 allows remote authenticated users with write access to exploit the vulnerability for injecting arbitrary web scripts or HTML.