CVE-2018-1999005: XSS

Q: What is the severity of CVE-2018-1999005?

CVE-2018-1999005 is classified as a high severity vulnerability due to its potential for cross-site scripting attacks.

Q: How do I fix CVE-2018-1999005?

To fix CVE-2018-1999005, update Jenkins to version 2.132 or later, or to 2.121.2.

Q: What software is affected by CVE-2018-1999005?

CVE-2018-1999005 affects Jenkins versions 2.132 and earlier as well as version 2.121.1 and earlier.

Q: What type of vulnerability is CVE-2018-1999005?

CVE-2018-1999005 is a cross-site scripting (XSS) vulnerability that allows attackers to execute JavaScript in another user's browser.

Q: Who can exploit CVE-2018-1999005?

An attacker with Job/Configure permission can exploit CVE-2018-1999005 to execute scripts in the browsers of other users.

Published Jul 23, 2018

Updated

A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidget/control.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.

Affected Software

5 affected componentsFixes available

maven/org.jenkins-ci.main:jenkins-core>=2.122<2.132

2.132

maven/org.jenkins-ci.main:jenkins-core<2.121.2

2.121.2

Jenkins Jenkins<=2.121.1

Jenkins Jenkins>=2.122<=2.132

Oracle Communications Cloud Native Core Automated Test Suite=1.9.0

Remediation

Patch Available

https://www.oracle.com/security-alerts/cpuapr2022.html

Event History

Jul 23, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

May 13, 2022

Advisory Published

01:01 AM

Frequently Asked Questions

What is the severity of CVE-2018-1999005?

CVE-2018-1999005 is classified as a high severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2018-1999005?