GHSA-wqjj-c9cx-q7cf

Jenkins Lockable Resources Plugin XSS vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-1003042

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.6wind.jenkins:lockable-resources	< 2.5	2.5

Details

As written in the advisory (Markdown source, shown as plain text).

A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-1003042 advisory
https://github.com/jenkinsci/lockable-resources-plugin/commit/4f401e250eb9e865e951b069255fea7052423739 web
https://access.redhat.com/errata/RHSA-2019:1423 web
https://github.com/jenkinsci/lockable-resources-plugin package
https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1361 web
http://www.openwall.com/lists/oss-security/2019/03/28/2 web
http://www.securityfocus.com/bid/107628 web