What’s Vulnerable › Vulnerabilities

CVE-2018-1000604

• Severity: medium (CVSS 5.4 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-06-26 · updated 2026-06-17
• Weakness: CWE-79

Description

A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.

Affected products

• Jenkins project Jenkins Badge Plugin: through 1.4

References

• https://jenkins.io/security/advisory/2018-06-25/#SECURITY-906
• https://jenkins.io/security/advisory/2018-06-25/#SECURITY-906

Get alerted when CVE-2018-1000604 or the next vulnerability affects your stack