~ / search / GHSA-jcmg-9rw5-9rm2

GHSA-jcmg-9rw5-9rm2

Stored XSS vulnerability in Jenkins Git Changelog Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000426

Packages

EcosystemPackageAffectedFixed in
Maven de.wellnerbou.jenkins:git-changelog < 2.7 2.7

Details

As written in the advisory (Markdown source, shown as plain text).

A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, GitLogBasicChangelogPostPublisher/config.jelly that allows attackers able to control the Git history parsed by the plugin to have Jenkins render arbitrary HTML on some pages.

References

External links from the advisory. They lead to third-party sites.