What’s Vulnerable › Vulnerabilities
CVE-2018-1000177
- Severity: medium (CVSS 5.4 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-05-08 · updated 2026-06-17
- Weakness: CWE-79
Description
A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containing JavaScript that would be executed in another user's browser when that user performs some UI actions.
Affected products
- Jenkins project Jenkins S3 publisher Plugin: through 0.10.12
References
Get alerted when CVE-2018-1000177 or the next vulnerability affects your stack