CVE-2018-1000202

{"id": "CVE-2018-1000202", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2018-06-05T21:29:00.807", "references": [{"url": "https://jenkins.io/security/advisory/2018-05-09/#SECURITY-821", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://jenkins.io/security/advisory/2018-05-09/#SECURITY-821", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions."}, {"lang": "es", "value": "Existe una vulnerabilidad de Cross-Site Scripting (XSS) persistente en el plugin Groovy Postbuild 2.3.1 y anteriores de Jenkins en varios archivos Jelly que permite que los atacantes puedan controlar el contenido de build badge para definir JavaScript que se ejecutar\u00eda en el navegador de otro usuario cuando este ejecute algunas acciones de la interfaz de usuario."}], "lastModified": "2024-11-21T03:39:55.557", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:groovy_postbuild:*:*:*:*:*:jenkins:*:*", "vulnerable": true, "matchCriteriaId": "E5CBE9D6-2C93-4D82-955C-F7FA69AE8464", "versionEndIncluding": "2.3.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}