Persisted Cross-Site Scripting in Jenkins by CloudBees
CVE-2017-2607

4.2MEDIUM

Key Information:

Vendor

[unknown]

Status
Jenkins
Vendor
CVE Published:
21 May 2018

What is CVE-2017-2607?

Jenkins, prior to versions 2.44 and 2.32.2, is susceptible to a persisted cross-site scripting vulnerability that mainly arises from its console notes feature. This allows users with malicious intent, including those with SCM access, to modify jobs or scripts to embed serialized console notes that can execute cross-site scripting attacks. When Jenkins users view the altered build logs, they may unknowingly execute harmful scripts, compromising the integrity and security of their environments.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

jenkins jenkins 2.44

jenkins jenkins 2.32.2

References

http://www.securityfocus.com/bid/95963
vdb-entryx_refsource_BID
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2607
x_refsource_CONFIRM

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.