{"id":"GHSA-7m8v-w6f9-q2f9","summary":"Cross-site Scripting in Jenkins Rebuilder Plugin","details":"A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in \n```\nRebuildAction/BooleanParameterValue.jelly,  \nRebuildAction/ExtendedChoiceParameterValue.jelly,  \nRebuildAction/FileParameterValue.jelly,  \nRebuildAction/LabelParameterValue.jelly,  \nRebuildAction/ListSubversionTagsParameterValue.jelly,  \nRebuildAction/MavenMetadataParameterValue.jelly,  \nRebuildAction/NodeParameterValue.jelly,  \nRebuildAction/PasswordParameterValue.jelly,  \nRebuildAction/RandomStringParameterValue.jelly,  \nRebuildAction/RunParameterValue.jelly,  \nRebuildAction/StringParameterValue.jelly,  \nRebuildAction/TextParameterValue.jelly,  \nRebuildAction/ValidatingStringParameterValue.jelly  \n```\nthat allows users with Job/Configuration permission to insert arbitrary HTML into rebuild forms.","aliases":["CVE-2018-1000415"],"modified":"2024-02-16T07:56:52.151564Z","published":"2022-05-14T01:38:17Z","database_specific":{"nvd_published_at":"2019-01-09T23:29:00Z","cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2022-11-03T19:12:53Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000415"},{"type":"WEB","url":"https://github.com/jenkinsci/rebuild-plugin/commit/3a4ca33a45fa048c9ab7b7082f87e72c0df848cb"},{"type":"WEB","url":"https://jenkins.io/security/advisory/2018-09-25/#SECURITY-130"},{"type":"WEB","url":"http://www.securityfocus.com/bid/106532"}],"affected":[{"package":{"name":"com.sonyericsson.hudson.plugins.rebuild:rebuild","ecosystem":"Maven","purl":"pkg:maven/com.sonyericsson.hudson.plugins.rebuild/rebuild"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29"}]}],"versions":["1.1","1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18","1.19","1.2","1.20","1.21","1.22","1.24","1.25","1.27","1.28","1.4","1.6","1.7","1.8","1.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-7m8v-w6f9-q2f9/GHSA-7m8v-w6f9-q2f9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}