Vulnerability Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/vulnerabilities/12302?format=api",
    "vulnerability_id": "VCID-u9v5-ymsx-fkgd",
    "summary": "Cross-site Scripting\nA cross-site scripting vulnerability in the Jenkins S3 Plugin allows attackers to define file names containing JavaScript that would be executed in another user's browser when that user performs some UI actions.",
    "aliases": [
        {
            "alias": "CVE-2018-1000177"
        },
        {
            "alias": "GHSA-3892-qqv6-h2qm"
        }
    ],
    "fixed_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/54394?format=api",
            "purl": "pkg:maven/org.jenkins-ci.plugins/s3@0.11",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.plugins/s3@0.11"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/packages/254230?format=api",
            "purl": "pkg:maven/org.jenkins-ci.plugins/s3@0.11.0",
            "is_vulnerable": false,
            "affected_by_vulnerabilities": [],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.plugins/s3@0.11.0"
        }
    ],
    "affected_packages": [
        {
            "url": "http://public2.vulnerablecode.io/api/packages/54393?format=api",
            "purl": "pkg:maven/org.jenkins-ci.plugins/s3@0.10.12",
            "is_vulnerable": true,
            "affected_by_vulnerabilities": [
                {
                    "vulnerability": "VCID-u9v5-ymsx-fkgd"
                }
            ],
            "resource_url": "http://public2.vulnerablecode.io/packages/pkg:maven/org.jenkins-ci.plugins/s3@0.10.12"
        }
    ],
    "references": [
        {
            "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2018-1000177",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "0.00058",
                    "scoring_system": "epss",
                    "scoring_elements": "0.18491",
                    "published_at": "2026-05-30T12:55:00Z"
                }
            ],
            "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-1000177"
        },
        {
            "reference_url": "https://jenkins.io/security/advisory/2018-04-16",
            "reference_id": "",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.4",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://jenkins.io/security/advisory/2018-04-16"
        },
        {
            "reference_url": "https://jenkins.io/security/advisory/2018-04-16/",
            "reference_id": "",
            "reference_type": "",
            "scores": [],
            "url": "https://jenkins.io/security/advisory/2018-04-16/"
        },
        {
            "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000177",
            "reference_id": "CVE-2018-1000177",
            "reference_type": "",
            "scores": [
                {
                    "value": "5.4",
                    "scoring_system": "cvssv3.1",
                    "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
                },
                {
                    "value": "MODERATE",
                    "scoring_system": "generic_textual",
                    "scoring_elements": ""
                }
            ],
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000177"
        }
    ],
    "weaknesses": [
        {
            "cwe_id": 1035,
            "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."
        },
        {
            "cwe_id": 79,
            "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
            "description": "The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."
        },
        {
            "cwe_id": 937,
            "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
            "description": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."
        }
    ],
    "exploits": [],
    "severity_range_score": "4.0 - 6.9",
    "exploitability": "0.5",
    "weighted_severity": "0.0",
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-u9v5-ymsx-fkgd"
}