{"id":"CVE-2018-1000416","details":"A reflected cross-site scripting vulnerability exists in Jenkins Job Config History Plugin 2.18 and earlier in all Jelly files that shows arbitrary attacker-specified HTML in Jenkins to users with Job/Configure access.","aliases":["GHSA-w3r4-vx9w-f7p7"],"modified":"2026-08-27T08:13:44.321383Z","published":"2019-01-09T23:29:02.607Z","references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/106532"},{"type":"ADVISORY","url":"https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1130"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkinsci/job-config-history-plugin","events":[{"introduced":"0"},{"last_affected":"8bacb79768b241d9458e2f46c8dfc215f8735aba"}],"database_specific":{"cpe":"cpe:2.3:a:jobconfighistory_project:jobconfighistory:*:*:*:*:*:jenkins:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"2.18"}],"source":"CPE_RANGE"}}],"versions":["jobConfigHistory-2.18","jobConfigHistory-2.17","jobConfigHistory-2.16","jobConfigHistory-2.15","jobConfigHistory-2.14","jobConfigHistory-2.12","jobConfigHistory-2.10","jobConfigHistory-2.9","jobConfigHistory-2.8","jobConfigHistory-2.6","jobConfigHistory-2.5","jobConfigHistory-2.4","jobConfigHistory-2.3","jobConfigHistory-2.2","jobConfigHistory-2.1.1","jobConfigHistory-2.1","jobConfigHistory-2.0","jobConfigHistory-1.13","jobConfigHistory-1.12","jobConfigHistory-1.11","jobConfigHistory-1.10","jobConfigHistory-1.9","jobConfigHistory-1.8","jobConfigHistory-1.7","jobConfigHistory-1.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1000416.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}