958957 – (CVE-2013-2033) CVE-2013-2033 Jenkins: Build Description XSS

Bug 958957 (CVE-2013-2033) - CVE-2013-2033 Jenkins: Build Description XSS

Summary: CVE-2013-2033 Jenkins: Build Description XSS

Keywords:
Status:	CLOSED ERRATA
Alias:	CVE-2013-2033
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	---
Assignee:	Red Hat Product Security
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:	958964 1008793
Blocks:	958963
TreeView+	depends on / blocked

Reported:	2013-05-02 19:08 UTC by Kurt Seifried
Modified:	2021-02-17 07:44 UTC (History)
CC List:	8 users (show)
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2014-02-13 01:15:16 UTC
Embargoed:

Attachments	(Terms of Use)

Description Kurt Seifried 2013-05-02 19:08:26 UTC

Reported by Jesse Glick:

The build description can contain an HTML link directive which will load a 
remote stylesheet. Attackers require the ability to create/modify jobs/builds 
in order to modify the build description.

Comment 2 Vincent Danen 2013-05-02 21:14:40 UTC

This is now public.

External references:

https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-05-02
https://issues.jenkins-ci.org/browse/SECURITY-67

Comment 4 David Jorm 2014-02-13 01:15:16 UTC

This issue has been addressed in following products:

  Red Hat OpenShift Enterprise 1.2

Via RHEA-2013:1032 https://rhn.redhat.com/errata/RHEA-2013-1032.html

Note You need to log in before you can comment on or make changes to this bug.