Mavenorg.
No fixed version published. Check the advisory or remove the package.
Affected versions
| If you run | Upgrade to |
|---|---|
| 1.14-860.vd06ef2568b and earlier | No fix published |
CVE-2024-28156 Medium · 5.4 EPSS 79.3%
Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names…
Jenkins Project · Jenkins Build Monitor View Plugin
Summary
The Build Monitor View names in the Jenkins Build Monitor View Plugin, version 1.14-860.vd06ef2568b_3f and earlier, are not escaped, which is a stored cross-site scripting flaw in that plugin. An attacker who can configure Build Monitor Views, and who can get a user to interact with the affected page, can run script in the context of that user's session over the network.
Official description · CVE.org
Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure Build Monitor Views.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
23.7 / 100
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 6 Mar 2024. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSV1 package in 1 ecosystem. Main package: org.jenkins-ci.plugins:build-monitor-plugin.