CVE-2017-1000103

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The custom Details view of the Static Analysis Utilities based DRY Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10001046.5The Config File Provider Plugin is used to centrally manage configuration files that often include secrets, such as passwords. Users with on CVE-2017-10001055.3The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before prov CVE-2017-10001068.5Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches co CVE-2017-10001078.8Script Security Plugin did not apply sandboxing restrictions to constructor invocations via positional arguments list, super constructor inv CVE-2017-10001087.5The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. Thi CVE-2017-10001096.1The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scrip CVE-2017-10001104.3Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches co CVE-2017-10001117.8Linux kernel: heap out-of-bounds in AF_PACKET sockets. This new issue is analogous to previously disclosed CVE-2016-8655. In both cases, a s CVE-2017-10001127.0Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() c CVE-2017-10001135.5The Deploy to container Plugin stored passwords unencrypted as part of its configuration. This allowed users with Jenkins master local file CVE-2017-10001143.1The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypte CVE-2017-10001157.5Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the reposito