3.5

CVE-2012-6074

Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cloudbees ≫ Jenkins Version <= 1.480.3.1
Jenkins ≫ Jenkins Version 1.400
Jenkins ≫ Jenkins Version 1.401
Jenkins ≫ Jenkins Version 1.402
Jenkins ≫ Jenkins Version 1.403
Jenkins ≫ Jenkins Version 1.404
Jenkins ≫ Jenkins Version 1.405
Jenkins ≫ Jenkins Version 1.406
Jenkins ≫ Jenkins Version 1.407
Jenkins ≫ Jenkins Version 1.408
Jenkins ≫ Jenkins Version 1.409
Jenkins ≫ Jenkins Version 1.410
Jenkins ≫ Jenkins Version 1.411
Jenkins ≫ Jenkins Version 1.412
Jenkins ≫ Jenkins Version 1.413
Jenkins ≫ Jenkins Version 1.414
Jenkins ≫ Jenkins Version 1.415
Jenkins ≫ Jenkins Version 1.416
Jenkins ≫ Jenkins Version 1.417
Jenkins ≫ Jenkins Version 1.418
Jenkins ≫ Jenkins Version 1.419
Jenkins ≫ Jenkins Version 1.420
Jenkins ≫ Jenkins Version 1.421
Jenkins ≫ Jenkins Version 1.422
Jenkins ≫ Jenkins Version 1.423
Jenkins ≫ Jenkins Version 1.424
Jenkins ≫ Jenkins Version 1.425
Jenkins ≫ Jenkins Version 1.426
Jenkins ≫ Jenkins Version 1.427
Jenkins ≫ Jenkins Version 1.428
Jenkins ≫ Jenkins Version 1.429
Jenkins ≫ Jenkins Version 1.430
Jenkins ≫ Jenkins Version 1.431
Jenkins ≫ Jenkins Version 1.432
Jenkins ≫ Jenkins Version 1.433
Jenkins ≫ Jenkins Version 1.434
Jenkins ≫ Jenkins Version 1.435
Jenkins ≫ Jenkins Version 1.436
Jenkins ≫ Jenkins Version 1.437
Cloudbees ≫ Jenkins Version 1.447.1.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.447.2.2 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.447.3.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.424.0.2 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.424.0.4 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.424.1.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.424.2.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.424.4.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.424.5.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.424.6.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.424.6.11 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.466.1.2 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.466.2.1 Update - Edition enterprise
Cloudbees ≫ Jenkins Version 1.400 Update - Edition lts
Cloudbees ≫ Jenkins Version 1.424 Update - Edition lts
Cloudbees ≫ Jenkins Version 1.447 Update - Edition lts
Jenkins ≫ Jenkins Version <= 1.466.2
Jenkins ≫ Jenkins Version 1.409.1
Jenkins ≫ Jenkins Version 1.409.2
Jenkins ≫ Jenkins Version 1.409.3
Jenkins ≫ Jenkins Version 1.424.1
Jenkins ≫ Jenkins Version 1.424.2
Jenkins ≫ Jenkins Version 1.424.3
Jenkins ≫ Jenkins Version 1.424.4
Jenkins ≫ Jenkins Version 1.424.5
Jenkins ≫ Jenkins Version 1.424.6
Jenkins ≫ Jenkins Version 1.447.1
Jenkins ≫ Jenkins Version 1.447.2
Jenkins ≫ Jenkins Version 1.466.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.42% 0.696
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://rhn.redhat.com/errata/RHSA-2013-0220.html
http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-11-20
Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/12/28/1
https://bugzilla.redhat.com/show_bug.cgi?id=890612