CVE-2017-1000102

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Details view of some Static Analysis Utilities based plugins, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to these plugins, for example the console output which is parsed to extract build warnings (Warnings Plugin), could insert arbitrary HTML into this view.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10001035.4The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability:CVE-2017-10001046.5The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with on CVE-2017-10001055.3The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before prov CVE-2017-10001068.5Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches co CVE-2017-10001078.8Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor inv CVE-2017-10001087.5The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. Thi CVE-2017-10001096.1The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scrip CVE-2017-10001104.3Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches co CVE-2017-10001117.8Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a s CVE-2017-10001127.0Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() c CVE-2017-10001135.5The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file CVE-2017-10001143.1The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypte