Description

A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.

Remediation

References

https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1361

http://www.openwall.com/lists/oss-security/2019/03/28/2

http://www.securityfocus.com/bid/107628

https://access.redhat.com/errata/RHSA-2019:1423

Related Vulnerabilities

CVE-2022-22984 Vulnerability in npm package snyk-mvn-plugin

CVE-2020-15841 Vulnerability in maven package com.liferay:com.liferay.portal.settings.authentication.ldap.web

CVE-2023-40037 Vulnerability in maven package org.apache.nifi:nifi-jms-processors

CVE-2021-20250 Vulnerability in maven package org.jboss:jboss-ejb-client

CVE-2021-43297 Vulnerability in maven package com.alibaba:hessian-lite

Severity

Medium

Classification

CWE-79 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Vendor Advisory Mailing List Third Party Advisory VDB Entry