CVE-2018-1000113

2018-03-1313:29:00

Google

osv.dev

0.001 Low

EPSS

Percentile

22.0%

JSON

A cross-site scripting vulnerability exists in Jenkins TestLink Plugin 2.12 and earlier in TestLinkBuildAction/summary.jelly and others that allow an attacker who can control e.g. TestLink report names to have Jenkins serve arbitrary HTML and JavaScript

CPENameOperatorVersion
testlink-plugineqtestlink-3.3
testlink-plugineqtestlink-3.2
testlink-plugineqtestlink-3.0
testlink-plugineqtestlink-3.1.5
testlink-plugineqtestlink-3.4
testlink-plugineqtestlink-3.1.3
testlink-plugineqtestlink-3.8-alpha
testlink-plugineqtestlink-3.12
testlink-plugineqtestlink-3.10
testlink-plugineqtestlink-3.1.7

Name	Operator	Version
testlink-plugin	eq	testlink-3.3
testlink-plugin	eq	testlink-3.2
testlink-plugin	eq	testlink-3.0
testlink-plugin	eq	testlink-3.1.5
testlink-plugin	eq	testlink-3.4
testlink-plugin	eq	testlink-3.1.3
testlink-plugin	eq	testlink-3.8-alpha
testlink-plugin	eq	testlink-3.12
testlink-plugin	eq	testlink-3.10
testlink-plugin	eq	testlink-3.1.7