CVE-2018-1000426

A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly…

published January 9, 2019

CVSS
—
EPSS
1%
Percentile
62.2
In the wild
Unconfirmed
What it is

A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, GitLogBasicChangelogPostPublisher/config.jelly that allows attackers able to control the Git history parsed by the plugin to have Jenkins render arbitrary HTML on some pages.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00993 · 62.2th percentile
Published
2019-01-09T23:00Z
EPSS history
Timeline
  • 09 JAN 23:00Z
    A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly…
    cvelistv5