3.5

CVE-2012-6074

Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.

Data is provided by the National Vulnerability Database (NVD)
Cloudbees ≫ Jenkins Version <= 1.480.3.1
Jenkins ≫ Jenkins Version1.400
Jenkins ≫ Jenkins Version1.401
Jenkins ≫ Jenkins Version1.402
Jenkins ≫ Jenkins Version1.403
Jenkins ≫ Jenkins Version1.404
Jenkins ≫ Jenkins Version1.405
Jenkins ≫ Jenkins Version1.406
Jenkins ≫ Jenkins Version1.407
Jenkins ≫ Jenkins Version1.408
Jenkins ≫ Jenkins Version1.409
Jenkins ≫ Jenkins Version1.410
Jenkins ≫ Jenkins Version1.411
Jenkins ≫ Jenkins Version1.412
Jenkins ≫ Jenkins Version1.413
Jenkins ≫ Jenkins Version1.414
Jenkins ≫ Jenkins Version1.415
Jenkins ≫ Jenkins Version1.416
Jenkins ≫ Jenkins Version1.417
Jenkins ≫ Jenkins Version1.418
Jenkins ≫ Jenkins Version1.419
Jenkins ≫ Jenkins Version1.420
Jenkins ≫ Jenkins Version1.421
Jenkins ≫ Jenkins Version1.422
Jenkins ≫ Jenkins Version1.423
Jenkins ≫ Jenkins Version1.424
Jenkins ≫ Jenkins Version1.425
Jenkins ≫ Jenkins Version1.426
Jenkins ≫ Jenkins Version1.427
Jenkins ≫ Jenkins Version1.428
Jenkins ≫ Jenkins Version1.429
Jenkins ≫ Jenkins Version1.430
Jenkins ≫ Jenkins Version1.431
Jenkins ≫ Jenkins Version1.432
Jenkins ≫ Jenkins Version1.433
Jenkins ≫ Jenkins Version1.434
Jenkins ≫ Jenkins Version1.435
Jenkins ≫ Jenkins Version1.436
Jenkins ≫ Jenkins Version1.437
Cloudbees ≫ Jenkins Version1.447.1.1 Update- Editionenterprise
Cloudbees ≫ Jenkins Version1.447.2.2 Update- Editionenterprise
Cloudbees ≫ Jenkins Version1.447.3.1 Update- Editionenterprise
Cloudbees ≫ Jenkins Version1.424.0.2 Update- Editionenterprise
Cloudbees ≫ Jenkins Version1.424.0.4 Update- Editionenterprise
Cloudbees ≫ Jenkins Version1.424.1.1 Update- Editionenterprise
Cloudbees ≫ Jenkins Version1.424.2.1 Update- Editionenterprise
Cloudbees ≫ Jenkins Version1.424.4.1 Update- Editionenterprise
Cloudbees ≫ Jenkins Version1.424.5.1 Update- Editionenterprise
Cloudbees ≫ Jenkins Version1.424.6.1 Update- Editionenterprise
Cloudbees ≫ Jenkins Version1.424.6.11 Update- Editionenterprise
Cloudbees ≫ Jenkins Version1.466.1.2 Update- Editionenterprise
Cloudbees ≫ Jenkins Version1.466.2.1 Update- Editionenterprise
Cloudbees ≫ Jenkins Version1.400 Update- Editionlts
Cloudbees ≫ Jenkins Version1.424 Update- Editionlts
Cloudbees ≫ Jenkins Version1.447 Update- Editionlts
Jenkins ≫ Jenkins Version <= 1.466.2
Jenkins ≫ Jenkins Version1.409.1
Jenkins ≫ Jenkins Version1.409.2
Jenkins ≫ Jenkins Version1.409.3
Jenkins ≫ Jenkins Version1.424.1
Jenkins ≫ Jenkins Version1.424.2
Jenkins ≫ Jenkins Version1.424.3
Jenkins ≫ Jenkins Version1.424.4
Jenkins ≫ Jenkins Version1.424.5
Jenkins ≫ Jenkins Version1.424.6
Jenkins ≫ Jenkins Version1.447.1
Jenkins ≫ Jenkins Version1.447.2
Jenkins ≫ Jenkins Version1.466.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.23% 0.424
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.