CVE-2018-1000177

A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jell…

published May 8, 2018

CVSS
—
EPSS
1%
Percentile
51.0
In the wild
Unconfirmed
What it is

A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containing JavaScript that would be executed in another user's browser when that user performs some UI actions.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00661 · 51.0th percentile
Published
2018-05-08T15:00Z
EPSS history
Timeline
  • 08 MAY 15:00Z
    A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jell…
    cvelistv5