An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade openshift-ansibleUpgrade openshift-enterprise-autohealUpgrade atomic-openshift-node-problem-detectorUpgrade golang-github-openshift-oauth-proxyUpgrade jenkinsUpgrade atomic-openshift-service-idlerUpgrade atomic-openshift-web-consoleUpgrade atomic-openshift-metrics-serverUpgrade openshift-enterprise-cluster-capacityUpgrade haproxyUpgrade golang-github-prometheus-node_exporterUpgrade golang-github-prometheus-alertmanagerUpgrade atomic-openshift-dockerregistryUpgrade atomic-enterprise-service-catalogUpgrade golang-github-prometheus-prometheusUpgrade jenkins-2-pluginsUpgrade atomic-openshiftUpgrade atomic-openshift-deschedulerUpgrade atomic-openshift-cluster-autoscaler | Mar 15, 2019 | Jan 28, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub