CVE-2018-1000413: XSS
First published: Wed Jan 09 2019(Updated: )
A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Config File Provider | <=3.1 | |
| maven/org.jenkins-ci.plugins:config-file-provider | <=3.1 | 3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/106532
- https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1080
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000413
- https://github.com/jenkinsci/config-file-provider-plugin/commit/5c1df554e44b712e5d926b8d5557c592bf9f0a33
- https://github.com/advisories/GHSA-vwfm-42q6-qj75 (Advisory)
Frequently Asked Questions
What is CVE-2018-1000413?
CVE-2018-1000413 is a cross-site scripting vulnerability that exists in Jenkins Config File Provider Plugin 3.1 and earlier.
What is the severity level of CVE-2018-1000413?
The severity level of CVE-2018-1000413 is medium, with a CVSS score of 5.4.
How can the cross-site scripting vulnerability be exploited in Jenkins Config File Provider Plugin?
The cross-site scripting vulnerability in Jenkins Config File Provider Plugin can be exploited by users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins.
Which version of Jenkins Config File Provider Plugin is affected by CVE-2018-1000413?
CVE-2018-1000413 affects Jenkins Config File Provider Plugin version 3.1 and earlier.
How can I fix CVE-2018-1000413?
To fix CVE-2018-1000413, it is recommended to upgrade Jenkins Config File Provider Plugin to a version later than 3.1.
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-vwfm-42q6-qj75
- alias/CVE-2018-1000413
- collector/nvd-cve
- collector/github-advisory
- agent/type
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/description
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/jenkins
- canonical/jenkins config file provider
- version/jenkins config file provider/3.1
- package-manager/maven