Description

Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permission to configure jobs were able to inject JavaScript into parameter names and descriptions.

Remediation

References

CVE-2017-2601

Related Vulnerabilities

Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4431)

WordPress 6.2.x Multiple Vulnerabilities (6.2 - 6.2.5)

Internet Information Services Permissions, Privileges, and Access Controls Vulnerability (CVE-1999-1011)

WordPress Plugin Advanced Woo Search Cross-Site Scripting (2.77)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-42048)

Severity

Medium

Classification

CVE-2017-2601 CWE-707 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities