CVE-2018-1000413

Description

A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins.

References

https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1080

http://www.securityfocus.com/bid/106532

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3