GHSA-cwh9-f8m6-6r63

Jenkins Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2014-3681

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.main:jenkins-core	>= 1.566, < 1.583	1.583
Maven	org.jenkins-ci.main:jenkins-core	< 1.565.3	1.565.3

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2014-3681 advisory
https://access.redhat.com/errata/RHBA-2014:1630 web
https://access.redhat.com/errata/RHSA-2016:0070 web
https://access.redhat.com/security/cve/CVE-2014-3681 web
https://bugzilla.redhat.com/show_bug.cgi?id=1147766 web
https://exchange.xforce.ibmcloud.com/vulnerabilities/96975 web
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01 web