netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-7qf3-c2q8-69m3
GHSA-mj7q-cmf3-mg7h
This commit is contained in:
advisory-database[bot]
2023-10-27 13:25:58 +00:00
parent 5c1eaf557a
commit 64d9de522e
2 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-7qf3-c2q8-69m3/GHSA-7qf3-c2q8-69m3.json
+4 -4
View File
@@ -1,17 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7qf3-c2q8-69m3",
"modified": "2022-12-13T14:56:21Z",
"modified": "2023-10-27T13:25:22Z",
"published": "2022-05-24T17:39:13Z",
"aliases": [
"CVE-2021-21610"
],
"summary": "Reflected XSS vulnerability in Jenkins markup formatter preview",
"details": "Jenkins allows administrators to choose the markup formatter to use for descriptions of jobs, builds, views, etc. displayed in Jenkins. When editing such a description, users can choose to have Jenkins render a formatted preview of the description they entered.\n\nJenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering the formatted preview of markup passed as a query parameter. This results in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup, like [Anything Goes Formatter Plugin](https://plugins.jenkins.io/anything-goes-formatter/).\n\nJenkins 2.275, LTS 2.263.2 requires that preview URLs are accessed using POST and sets Content-Security-Policy headers that prevent execution of unsafe elements when the URL is accessed directly.\\n\\nIn case of problems with this change, these protections can be disabled by setting the [Java system properties](https://www.jenkins.io/doc/book/managing/system-properties/) `hudson.markup.MarkupFormatter.previewsAllowGET` to `true` and/or `hudson.markup.MarkupFormatter.previewsSetCSP` to `false`. Doing either is discouraged.",
"details": "Jenkins allows administrators to choose the markup formatter to use for descriptions of jobs, builds, views, etc. displayed in Jenkins. When editing such a description, users can choose to have Jenkins render a formatted preview of the description they entered.\n\nJenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering the formatted preview of markup passed as a query parameter. This results in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup, like [Anything Goes Formatter Plugin](https://plugins.jenkins.io/anything-goes-formatter/).\n\nJenkins 2.275, LTS 2.263.2 requires that preview URLs are accessed using POST and sets Content-Security-Policy headers that prevent execution of unsafe elements when the URL is accessed directly.\n\nIn case of problems with this change, these protections can be disabled by setting the [Java system properties](https://www.jenkins.io/doc/book/managing/system-properties/) `hudson.markup.MarkupFormatter.previewsAllowGET` to `true` and/or `hudson.markup.MarkupFormatter.previewsSetCSP` to `false`. Doing either is discouraged.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -78,7 +78,7 @@
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2022-06-24T00:51:20Z",
"nvd_published_at": "2021-01-13T16:15:00Z"
advisories/github-reviewed/2022/05/GHSA-mj7q-cmf3-mg7h/GHSA-mj7q-cmf3-mg7h.json
+3 -3
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mj7q-cmf3-mg7h",
"modified": "2022-12-13T14:58:30Z",
"modified": "2023-10-27T13:24:26Z",
"published": "2022-05-24T17:39:13Z",
"aliases": [
"CVE-2021-21611"
@@ -11,7 +11,7 @@
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -78,7 +78,7 @@
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2022-06-23T06:50:48Z",
"nvd_published_at": "2021-01-13T16:15:00Z"