The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins users, or users with SCM access, could configure jobs or modify build scripts such that they print serialized console notes that perform cross-site scripting attacks on Jenkins users viewing the build logs.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Feb 2, 2017 | Feb 1, 2017 |
| Jenkins 2017 02 01 | — | Upgrade Jenkins to version 2.44Upgrade Jenkins LTS to version 2.32.2Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest version | May 21, 2018 | May 21, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub