1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-1490

[JENKINS:SECURITY-1490] Reflected XSS vulnerability in `build-metrics`

Severity Medium
Affected Packages 2
CVEs 1
Info Packages References Vulnerabilities

build-metrics does not properly escape the label query parameter, resulting in a reflected cross-site scripting vulnerability.

As of publication of this advisory, there is no fix.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/build-metrics <= 1.3
pkg:github/jenkinsci/build-metrics-plugin <= 1.3
ID
JENKINS:SECURITY-1490
Severity
medium
Published
2019-10-23T00:00:00
(4 years ago)
Modified
2019-10-23T00:00:00
(4 years ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository build-metrics repository https://github.com/jenkinsci/build-metrics-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/build-metrics org.jenkins-ci.plugins build-metrics <= 1.3
Affected pkg:github/jenkinsci/build-metrics-plugin jenkinsci build-metrics-plugin <= 1.3
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date