Cross-site scripting (XSS) vulnerability in the slave overview page in Jenkins before 1.638 and LTS before 1.625.2 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the slave offline status message.
CVSS Details
- CVSS 3.1 Base Score: 5.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Jenkins 2015 11 11 | — | Upgrade Jenkins LTS to version 1.625.2Upgrade Jenkins to version 1.638Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest version | Nov 13, 2017 | Nov 25, 2015 |
| Redhat Openshift | — | Upgrade openshift-ansibleUpgrade nodejs-lodash.basecopyUpgrade nodejs-object-assignUpgrade nodejs-graceful-fsUpgrade nodejs-iniUpgrade atomic-openshiftUpgrade nodejs-parse-globUpgrade nodejs-is-extglobUpgrade nodejs-uuidUpgrade nodejs-is-binary-pathUpgrade nodejs-event-streamUpgrade openshift-origin-cartridge-mysqlUpgrade nodejs-is-equal-shallowUpgrade nodejs-nodemonUpgrade openshift-origin-cartridge-phpUpgrade nodejs-end-of-streamUpgrade nodejs-deep-extendUpgrade nodejs-lodash.isarrayUpgrade rubygem-openshift-origin-nodeUpgrade nodejs-fill-rangeUpgrade nodejs-readdirpUpgrade nodejs-timed-outUpgrade nodejs-ansi-wrapUpgrade nodejs-lodash.keysUpgrade nodejs-lodash.baseassignUpgrade nodejs-duplexerUpgrade nodejs-filename-regexUpgrade activemqUpgrade nodejs-lodash.getnativeUpgrade nodejs-bracesUpgrade nodejs-for-inUpgrade nodejs-chokidarUpgrade openshift-origin-node-proxyUpgrade nodejs-arrifyUpgrade nodejs-string-lengthUpgrade nodejs-lodash.defaultsUpgrade nodejs-prepend-httpUpgrade nodejs-splitUpgrade nodejs-slideUpgrade nodejs-glob-baseUpgrade nodejs-update-notifierUpgrade nodejs-micromatchUpgrade nodejs-is-npmUpgrade nodejs-lodash.restparamUpgrade nodejs-lodash.isiterateecallUpgrade openshift-origin-cartridge-pythonUpgrade nodejs-parse-jsonUpgrade nodejs-lodash.createassignerUpgrade nodejs-pinkie-promiseUpgrade nodejs-read-all-streamUpgrade nodejs-semver-diffUpgrade rhcUpgrade nodejs-package-jsonUpgrade nodejs-semverUpgrade nodejs-normalize-pathUpgrade nodejs-is-extendableUpgrade nodejs-success-symbolUpgrade nodejs-randomaticUpgrade nodejs-for-ownUpgrade nodejs-unzip-responseUpgrade nodejs-is-plain-objUpgrade heapsterUpgrade rubygem-openshift-origin-consoleUpgrade nodejs-touchUpgrade nss_wrapperUpgrade nodejs-xdg-basedirUpgrade nodejs-duplexifyUpgrade nodejs-fromUpgrade nodejs-glob-parentUpgrade openshift-origin-broker-utilUpgrade nodejs-configstoreUpgrade openshift-enterprise-upgradeUpgrade nodejs-write-file-atomicUpgrade nodejs-expand-bracketsUpgrade nodejs-strip-json-commentsUpgrade nodejs-is-numberUpgrade nodejs-pinkieUpgrade nodejs-regex-cacheUpgrade nodejs-arr-diffUpgrade nodejs-registry-urlUpgrade rubygem-openshift-origin-commonUpgrade nodejs-url-parse-laxUpgrade nodejs-undefsafeUpgrade nodejs-async-eachUpgrade nodejs-gotUpgrade nodejs-binary-extensionsUpgrade nodejs-os-homedirUpgrade nodejs-preserveUpgrade phpUpgrade nodejs-align-textUpgrade nodejs-pause-streamUpgrade nodejs-is-redirectUpgrade nodejs-capture-stack-traceUpgrade nodejs-throughUpgrade nodejs-repeat-elementUpgrade nodejs-is-dotfileUpgrade nodejs-extglobUpgrade nodejs-arr-flattenUpgrade nodejs-isobjectUpgrade nodejs-lazy-cacheUpgrade openvswitchUpgrade nodejs-object.omitUpgrade nodejs-is-globUpgrade nodejs-error-exUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs-osenvUpgrade nodejs-mkdirpUpgrade nodejs-create-error-classUpgrade nodejs-array-uniqueUpgrade nodejs-lodash.assignUpgrade nodejs-is-primitiveUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs-kind-ofUpgrade nodejs-es6-promiseUpgrade nodejs-os-tmpdirUpgrade origin-kibanaUpgrade nodejs-rcUpgrade nodejs-lodash.bindcallbackUpgrade nodejs-lodash.isargumentsUpgrade openshift-origin-msg-node-mcollectiveUpgrade jenkinsUpgrade nodejs-expand-rangeUpgrade nodejs-stream-combinerUpgrade openshift-origin-node-utilUpgrade nodejs-optimistUpgrade nodejs-node-status-codesUpgrade nodejs-latest-versionUpgrade openshift-origin-cartridge-cronUpgrade nodejs-anymatchUpgrade nodejs-lowercase-keysUpgrade rubygem-openshift-origin-controllerUpgrade nodejs-ps-treeUpgrade nodejs-is-streamUpgrade nodejs-map-streamUpgrade nodejs-ansi-green | Jun 18, 2018 | Nov 11, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub