packetstormsecurity.com
http://packetstormsecurity.com/files/124513 CVE-2013-5573
Jenkins allows Cross-Site Scripting (XSS) in User Configuration
Record summary
EIP currently links 1 catalogued exploit to CVE-2013-5573.
Description
Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
org.jenkins-ci.main:jenkins-coreBrowse Maven / org.jenkins-ci.main:jenkins-core | GitHub Advisory | Through 1.523 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBJenkins 1.523 - Persistent HTML CodeExploitDB exploitby Christian CatalanoNot analyzed1 file
References
1020131217 [CVE-2013-5573] Jenkins v1.523 Default markup formatter permits offsite-bound formsmailing list
http://seclists.org/bugtraq/2013/Dec/104 20131217 [CVE-2013-5573] Jenkins v1.523 Default markup formatter permits offsite-bound formsmailing list
http://seclists.org/fulldisclosure/2013/Dec/159 30408exploit
http://www.exploit-db.com/exploits/30408 101187vdb entry
http://www.osvdb.org/101187 64414vdb entry
http://www.securityfocus.com/bid/64414 jenkins-cve20135573-xss(89872)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/89872 github.com
https://github.com/jenkinsci/jenkins nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2013-5573 web.archive.org
https://web.archive.org/web/20200229071540/http://www.securityfocus.com/bid/64414