An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade golang-github-prometheus-prometheusUpgrade openshift-enterprise-cluster-capacityUpgrade atomic-openshift-cluster-autoscalerUpgrade atomic-openshift-dockerregistryUpgrade haproxyUpgrade atomic-enterprise-service-catalogUpgrade atomic-openshiftUpgrade golang-github-prometheus-alertmanagerUpgrade jenkins-2-pluginsUpgrade golang-github-prometheus-node_exporterUpgrade atomic-openshift-deschedulerUpgrade openshift-ansibleUpgrade openshift-enterprise-autohealUpgrade atomic-openshift-web-consoleUpgrade atomic-openshift-service-idlerUpgrade atomic-openshift-metrics-serverUpgrade jenkinsUpgrade golang-github-openshift-oauth-proxyUpgrade atomic-openshift-node-problem-detector | Mar 15, 2019 | Jan 28, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub