CVE-2018-1999029

A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjectsAction/index.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.

Score

CVSS 3.0 5.4 Medium

Status

Modified - cve@mitre.org

Published

2018-08-01

Last modified

2024-09-16

Weaknesses

CWE-79

Affected products

• Shelve Project (Jenkins)

References

• https://jenkins.io/security/advisory/2018-07-30/#SECURITY-1001