[JIRA] (JENKINS-37896) Cross-site scripting in search box of Jenkins version 1.607 exposed by enterprise web scan.

[cba...@cimarroninc.com (JIRA)]

Title: Message Title

Carl Bandy created an issue   Jenkins / JENKINS-37896 Cross-site scripting in search box of Jenkins version 1.607 exposed by enterprise web scan. Issue Type: Bug Assignee: Unassigned Components: core Created: 2016/Sep/01 2:33 PM Priority: Major Reporter: Carl Bandy An enterprise web scan found a cross-site scripting vulnerability in the kingdom of "Input Validation and Representation" in our instance of Jenkins version 1.607. See excerpts from the report (shown below). Request: GET /search/suggestOpenSearch?q= {searchTerms}%3c%73%43%72%49%70%54%20%74%59%70%45%3d%74%45%78%54%2f%76%42%73%43%72%49%70%54%3e%4d%73%67%42%6f%78%28%37%36%36%34%37%29%3c%2f%73%43%72%49%70%54%3e HTTP/1.1 Referer: https://<jenkins_hostname>:<jenkins_port>/opensearch.xml ... Response: HTTP/1.1 200 OK X-Content-Type-Options: nosniff Content-Type: application/json;charset=UTF-8 Content-Length: 69 Server: Jetty(winstone-2.8) ["{searchTerms} <sCrIpT tYpE=tExT/_vbscript_>MsgBox(76647)</sCrIpT Add Comment   This message was sent by Atlassian JIRA (v7.1.7#71011-sha1:2526d7c) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.