CVE-2018-1999005

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.132 Jenkins versions prior to 2.121.1

Description A cross-site scripting issue exists that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions. This issue is related to the BuildTimelineWidget.java and BuildTimelineWidget/control.jelly files.

Recommendations For versions prior to 2.132, update to a version later than 2.132 to resolve the issue. For versions prior to 2.121.1, update to a version later than 2.121.1 to resolve the issue. As a temporary workaround, consider restricting the Job/Configure permission to minimize the risk of exploitation.