1. Home
  2. Vulnerabilities
  3. CVE-2018-1000202

CVE-2018-1000202

CVSS v3.0 5.4 (Medium)
54% Progress
CVSS v2.0 3.5 (Low)
35% Progress
EPSS 0.05 % (22th)
0.05% Progress
Affected Products 1
Advisories 2
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Graph Web & Social Timeline

A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.

Weaknesses
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE Status
PUBLISHED
CNA
MITRE
Published Date
2018-06-05 21:29:00
(6 years ago)
Updated Date
2018-07-18 19:51:25
(6 years ago)

Affected Products

Jenkins

Configuration #1

    CPE23 From Up To
  Jenkins Groovy Postbuild for Jenkins 2.3.1 and prior versions cpe:2.3:a:jenkins:groovy_postbuild::*:*:*:*:jenkins <= 2.3.1