Skip to content
fr Sign in
4.2 Medium

CVE-2017-2607 jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes…

Description

jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins users, or users with SCM access, could configure jobs or modify build scripts such that they print serialized console notes that perform cross-site scripting attacks on Jenkins users viewing the build logs.

Affected products and versions

Product Affected versions Fixed in
jenkins Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of jenkins

The 12 CVEs of jenkins →
CVE-2017-2598 Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes… 4.3 Medium CVE-2017-2609 jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions… 4.3 Medium CVE-2017-2613 jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins 5.4 Medium CVE-2017-2602 jenkins before versions 2.44, 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the… 3.1 Low
Track this CVE