An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade atomic-openshift-cluster-autoscalerUpgrade atomic-openshift-service-idlerUpgrade atomic-openshift-node-problem-detectorUpgrade openshift-enterprise-cluster-capacityUpgrade atomic-enterprise-service-catalogUpgrade atomic-openshift-deschedulerUpgrade jenkins-2-pluginsUpgrade golang-github-openshift-oauth-proxyUpgrade atomic-openshiftUpgrade golang-github-prometheus-alertmanagerUpgrade golang-github-prometheus-node_exporterUpgrade jenkinsUpgrade openshift-enterprise-autohealUpgrade haproxyUpgrade atomic-openshift-metrics-serverUpgrade openshift-ansibleUpgrade atomic-openshift-dockerregistryUpgrade golang-github-prometheus-prometheusUpgrade atomic-openshift-web-console | Mar 15, 2019 | Jan 28, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub