CVE-2017-1000404

描述

The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScript, resulting in a cross-site scripting vulnerability through specially crafted URLs. Version 1.0.8 of the plugin converts the value to a boolean (true/false) and inserts that into the page instead.

如何修補 CVE-2017-1000404

要修補 CVE-2017-1000404,請將受影響套件升級到下列已修補版本。

• —升級至 1.0.8 或更新版本

CVE-2017-1000404 正在被利用嗎?

低 — EPSS 為 1.0%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1.0.8

CVSS 分數

參考連結(3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2017-1000404
• WEBjenkins.io/security/advisory/2017-11-16
• WEBwww.securityfocus.com/bid/101927