CVE-2018-1000177

{"id": "CVE-2018-1000177", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2018-05-08T15:29:00.457", "references": [{"url": "https://jenkins.io/security/advisory/2018-04-16/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://jenkins.io/security/advisory/2018-04-16/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containing JavaScript that would be executed in another user's browser when that user performs some UI actions."}, {"lang": "es", "value": "Existe una vulnerabilidad Cross-Site Scripting (XSS) en el plugin S3 en versiones 0.10.12 y posteriores para Jenkins en src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly que permite que los atacantes puedan controlar los nombres de los archivos subidos para definir nombres de archivo que contengan c\u00f3digo JavaScript que luego se ejecutar\u00eda en el navegador de otro usuario cuando dicho usuario realice determinadas acciones en la interfaz de usuario."}], "lastModified": "2024-11-21T03:39:51.517", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:s3_publisher:*:*:*:*:*:jenkins:*:*", "vulnerable": true, "matchCriteriaId": "7BBEA231-C1B1-44C6-B39D-BB72819EC7C5", "versionEndIncluding": "0.10.12"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}