Jenkins allows Cross-Site Scripting (XSS)
Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2015-5326US | medium4.3 | — | ||
Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inj… | ||||
02
references
External citations — patches, advisories, analysis.
- http://rhn.redhat.com/errata/RHSA-2016-0489.htmlWEB
- https://access.redhat.com/errata/RHSA-2016:0070WEB
- https://github.com/jenkinsci/jenkinsPACKAGE
- https://github.com/jenkinsci/jenkins/commit/abe561499bbba2e725804c1117fc957028bbd608WEB
- https://nvd.nist.gov/vuln/detail/CVE-2015-5326ADVISORY
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan