CVE-2018-1000426: Stored XSS vulnerability in Jenkins Git Changelog Plugin
Summary
CVE-2018-1000426: Stored XSS vulnerability in Jenkins Git Changelog Plugin. Affects de.wellnerbou.jenkins:git-changelog versions < 2.7. Fixed in 2.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jenkins Git Changelog Plugin is a Maven package (de.wellnerbou.jenkins:git-changelog) that provides functionality for generating changelogs from Git repositories in Jenkins. It allows users to parse Git history and render changelogs on Jenkins pages.
Vulnerability Detail
A cross-site scripting (XSS) vulnerability has been discovered in Jenkins Git Changelog Plugin versions 2.6 and earlier. The vulnerability exists in several files of the plugin, including GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, and GitLogBasicChangelogPostPublisher/config.jelly. Attackers who can control the Git history parsed by the plugin can exploit this vulnerability to inject arbitrary HTML code, which will be rendered by Jenkins on certain pages. This can lead to unauthorized access, data theft, or other malicious activities.
How To Fix
Minimum fixed version
2.7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the plugin to the fixed version as soon as possible.
Conclusion
The Jenkins Git Changelog Plugin is vulnerable to a stored XSS vulnerability that allows attackers to inject arbitrary HTML code. To mitigate this risk, it is crucial to update the plugin to version 2.7 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for de.wellnerbou.jenkins:git-changelog →
FAQ
The vulnerability allows attackers to inject arbitrary HTML code, which can lead to unauthorized access, data theft, or other malicious activities.
Users of Jenkins Git Changelog Plugin versions 2.6 and earlier are affected by this vulnerability.
Yes, upgrading to Jenkins Git Changelog Plugin version 2.7 or later fixes this vulnerability.
No, there are no known workarounds. Updating the plugin to the fixed version is the recommended solution.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for de.wellnerbou.jenkins:git-changelog.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
