GHSA-wqjj-c9cx-q7cf

Source

https://github.com/advisories/GHSA-wqjj-c9cx-q7cf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-wqjj-c9cx-q7cf/GHSA-wqjj-c9cx-q7cf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wqjj-c9cx-q7cf

Aliases

CVE-2019-1003042

Published

2022-05-13T01:25:43Z

Modified

2024-02-16T08:24:45.880347Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Jenkins Lockable Resources Plugin XSS vulnerability

Details

A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.

Database specific

{
    "nvd_published_at": "2019-03-28T18:29:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-09T22:34:57Z"
}

References

Affected packages

Maven / org.6wind.jenkins:lockable-resources

Package

Name: org.6wind.jenkins:lockable-resources; View open source insights on deps.dev
Purl: pkg:maven/org.6wind.jenkins/lockable-resources

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.5

Affected versions

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

1.10

1.11

1.11.1

1.11.2

2.*

2.0

2.1

2.2

2.3

2.4

Database specific

{
    "last_known_affected_version_range": "<= 2.4"
}