5.4 Moyenne

CVE-2023-28670 Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's…

Description

Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Jenkins Pipeline Aggregator View Plugin 1.13	premières → 1.13	Pas de correctif indiqué

Les 2 CVE de Jenkins Pipeline Aggregator View Plugin →

CVE-2019-16564 Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a… Non notée

Vous utilisez Jenkins Pipeline Aggregator View Plugin ?

Suivre cette CVE Surveiller Jenkins Pipeline Aggregator View Plugin Vérifier mes SBOM

www.cveye.io/fr/cve/CVE-2023-28670

Chronologie

Publiée 23 mars 2023
Dernière modification 25 février 2025

Références

Jenkins Security Advisory 2023-03-21 www.jenkins.io

Suivre cette CVE

CVE-2023-28670 Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's…

Description

Produits et versions touchés

Autres CVE de Jenkins Pipeline Aggregator View Plugin