CVSS: 6.1EPSS: 96%CPEs: 1EXPL: 2CVE-2020-2096 – Jenkins Gitlab Hook Plugin 1.4.2 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2020-2096
Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability. Jenkins Gitlab Hook Plugin versión 1.4.2 y versiones anteriores, no escapa nombres de proyecto en el endpoint build_now, lo que resulta en una vulnerabilidad de tipo XSS reflejada. Jenkins Gitlab Hook plugin version 1.4.2 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/47927 http://packetstormsecurity.com/files/155967/Jenkins-Gitlab-Hook-1.4.2-Cross-Site-Scripting.html http://www.openwall.com/lists/oss-security/2020/01/15/1 https://jenkins.io/security/advisory/2020-01-15/#SECURITY-1683 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1000196
https://notcve.org/view.php?id=CVE-2018-1000196
A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_notifier/global.erb that allows attackers with local Jenkins master file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured Gitlab token. Existe una vulnerabilidad de exposición de información sensible en el plugin Gitlab Hook en versiones 1.4.2 y anteriores de Jenkins en gitlab_notifier.rb y views/gitlab_notifier/global.erb que permite a los atacantes con acceso al sistema de ficheros maestro local de Jenkins o control del navegador web de un administrador de Jenkins (por ejemplo, extensión maliciosa) recuperar el token Gitlab configurado. • https://jenkins.io/security/advisory/2018-05-09/#SECURITY-263 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •