Stored XSS vulnerability in Config File Provider Plugin
Date: 2022-05
Affected: maven/org.jenkins-ci.plugins:config-file-provider
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2018-1000407
CVE-2018-1000413
CVE-2018-1000415
CVE-2018-1000416
CVE-2018-1000426
CWE: CWE-79
CVSS: 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

A cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.1 and earlier in configfiles.jelly, providerlist.jelly that allows users with the ability to configure configuration files to insert arbitrary HTML into some pages in Jenkins.


Mitigations:

Architectural layers (MAESTRO):