GHSA-x97g-3gp9-cf2p

Source

https://github.com/advisories/GHSA-x97g-3gp9-cf2p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-x97g-3gp9-cf2p/GHSA-x97g-3gp9-cf2p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x97g-3gp9-cf2p

Aliases

CVE-2012-4439

Published

2022-04-23T00:40:12Z

Modified

2025-03-12T16:27:11Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Jenkins allows Cross-Site Scripting (XSS) via Crafted URL

Details

Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-12T15:53:52Z",
    "nvd_published_at": "2019-11-18T21:15:00Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven / org.jenkins-ci.main:jenkins-core

Package

Name: org.jenkins-ci.main:jenkins-core; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.main/jenkins-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.466.2

Affected versions

1.*

1.396

1.397

1.398

1.399

1.400

1.401

1.403

1.404

1.405

1.406

1.407

1.408

1.409

1.409.1

1.409.2

1.409.3

1.410

1.411

1.412

1.413

1.414

1.415

1.416

1.417

1.418

1.419

1.420

1.421

1.422

1.423

1.424

1.424.1

1.424.2

1.424.3

1.424.4

1.424.5

1.424.6

1.425

1.426

1.427

1.428

1.429

1.430

1.431

1.432

1.433

1.434

1.435

1.436

1.437

1.438

1.439

1.440

1.441

1.442

1.443

1.444

1.445

1.446

1.447

1.447.1

1.447.2

1.448

1.449

1.450

1.451

1.452

1.453

1.454

1.455

1.456

1.457

1.458

1.459

1.460

1.461

1.462

1.463

1.464

1.465

1.466

1.466.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-x97g-3gp9-cf2p/GHSA-x97g-3gp9-cf2p.json"

Maven / org.jenkins-ci.main:jenkins-core

Package

Name: org.jenkins-ci.main:jenkins-core; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.main/jenkins-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.467

Fixed

1.482

Affected versions

1.*

1.467

1.468

1.469

1.470

1.471

1.472

1.473

1.474

1.475

1.476

1.477

1.478

1.479

1.480

1.480.1

1.480.2

1.480.3

1.481

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-x97g-3gp9-cf2p/GHSA-x97g-3gp9-cf2p.json"