Jenkins Sidebar Link Plugin CVE-2017-1000088 HTML Injection Vulnerability

Bugtraq ID:	100942
Class:	Input Validation Error
CVE:	CVE-2017-1000088
Remote:	Yes
Local:	No
Published:	Jul 10 2017 12:00AM
Updated:	Jul 10 2017 12:00AM
Credit:	Suhas Sunil Gaikwad
Vulnerable:	Jenkins-Ci Sidebar-Link Plugin 1.8 Jenkins-Ci Sidebar-Link Plugin 1.7 Jenkins-Ci Sidebar-Link Plugin 1.6 Jenkins-Ci Sidebar-Link Plugin 1.5 Jenkins-Ci Sidebar-Link Plugin 1.4 Jenkins-Ci Sidebar-Link Plugin 1.3 Jenkins-Ci Sidebar-Link Plugin 1.2 Jenkins-Ci Sidebar-Link Plugin 1.1 Jenkins-Ci Sidebar-Link Plugin 1.0
Not Vulnerable:	Jenkins-Ci Sidebar-Link Plugin 1.9

Jenkins Sidebar Link Plugin CVE-2017-1000088 HTML Injection Vulnerability

The Sidebar Link Plugin for Jenkins is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the page is rendered to the user. Other attacks are also possible.

Sidebar Link Plugin 1.8 and prior versions are vulnerable.

Jenkins Sidebar Link Plugin CVE-2017-1000088 HTML Injection Vulnerability

An attacker can exploit this issue using a web browser.

Jenkins Sidebar Link Plugin CVE-2017-1000088 HTML Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Jenkins Sidebar Link Plugin CVE-2017-1000088 HTML Injection Vulnerability

References:

• Jenkins CI Homepage (Jenkins CI)
  
• Sidebar-Link Plugin Homepage (Jenkins)
  
• Jenkins Security Advisory 2017-07-10 (Jenkins)