Description

Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.

Remediation

References

CVE-2017-1000392

Related Vulnerabilities

OpenVPN AS Improper Neutralization of CRLF Sequences ('CRLF Injection') Vulnerability (CVE-2017-5868)

WordPress Plugin Essential Addons for Elementor Cross-Site Scripting (5.0.8)

WordPress Plugin SEO Ultimate 'wp-admin/post.php' Cross-Site Scripting (6.9.1)

PHP Out-of-bounds Write Vulnerability (CVE-2017-9228)

WordPress Plugin WP-DBManager 'wp-config.php' Arbitrary File Download (2.60)

Severity

Medium

Classification

CVE-2017-1000392 CWE-707 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities