CVSS 3.0
5.4 mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2018-1000202
Medium (5.4) in jenkins groovy postbuild. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in org.jvnet.hudson.plugins:groovy-postbuild 2.4.
A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:groovy_postbuild
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-38ch-x695-m794 | Maven | org.jvnet.hudson.plugins:groovy-postbuild | <2.4 | 2.4 |