GHSA-q7jx-r75r-hgj2

Source

https://github.com/advisories/GHSA-q7jx-r75r-hgj2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-q7jx-r75r-hgj2/GHSA-q7jx-r75r-hgj2.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-q7jx-r75r-hgj2

Aliases

CVE-2018-1000144

Published

2022-05-14T03:23:50Z

Modified

2023-11-01T04:48:34.309422Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Jenkins Cucumber Living Documentation Plugin Cross-site Scripting vulnerability

Details

A cross site scripting vulnerability exists in Jenkins Cucumber Living Documentation Plugin 1.0.12 and older in CukedoctorBaseAction#doDynamic that disables the Content-Security-Policy protection for archived artifacts and workspace files, allowing attackers able to control the content of these files to attack Jenkins users. This has been addressed in version 1.1.0 of the plugin, and it will now request that users change the Content-Security-Policy option in Jenkins.

Database specific

{
    "nvd_published_at": "2018-04-05T13:29:00Z",
    "github_reviewed_at": "2022-12-12T21:30:54Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Maven / org.jenkins-ci.plugins:cucumber-living-documentation

Package

Name: org.jenkins-ci.plugins:cucumber-living-documentation; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/cucumber-living-documentation

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.0

Database specific

{
    "last_known_affected_version_range": "<= 1.0.12"
}