CVE-2018-1000413: XSS
A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-1000413?
CVE-2018-1000413 is a cross-site scripting vulnerability that exists in Jenkins Config File Provider Plugin 3.1 and earlier.
What is the severity level of CVE-2018-1000413?
The severity level of CVE-2018-1000413 is medium, with a CVSS score of 5.4.
How can the cross-site scripting vulnerability be exploited in Jenkins Config File Provider Plugin?
The cross-site scripting vulnerability in Jenkins Config File Provider Plugin can be exploited by users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins.
Which version of Jenkins Config File Provider Plugin is affected by CVE-2018-1000413?
CVE-2018-1000413 affects Jenkins Config File Provider Plugin version 3.1 and earlier.
How can I fix CVE-2018-1000413?
To fix CVE-2018-1000413, it is recommended to upgrade Jenkins Config File Provider Plugin to a version later than 3.1.