Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2019-1003050

UNKNOWN
Published 2019-04-10T20:12:30
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2019-1003050. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

Jenkins project

Jenkins

Affected Versions:

2.171 and earlier, LTS 2.164.1 and earlier

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed MODERATE

Improper Neutralization of Input During Web Page Generation in Jenkins

GHSA-qpg9-83fv-x9ch

Advisory Details

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.

Affected Packages

Maven org.jenkins-ci.main:jenkins-core
ECOSYSTEM: ≥0 <2.164.2
Maven org.jenkins-ci.main:jenkins-core
ECOSYSTEM: ≥2.165 <2.172

CVSS Scoring

CVSS Score

5.0

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2019-1003050
WEB https://github.com/jenkinsci/jenkins/commit/8eb632dda219ec8796420ce58d9564cddf8f8f93
WEB https://github.com/jenkinsci/jenkins/commit/d393c7e9ba3ec44953ef1f8b11839421e2649ee7
WEB https://access.redhat.com/errata/RHBA-2019:1605
PACKAGE https://github.com/jenkinsci/jenkins
WEB https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1327
WEB https://www.oracle.com/security-alerts/cpuapr2022.html
WEB http://www.securityfocus.com/bid/107889

Advisory provided by GitHub Security Advisory Database. Published: May 13, 2022, Modified: October 26, 2023

References

http://www.securityfocus.com/bid/107889
https://access.redhat.com/errata/RHBA-2019:1605
https://www.oracle.com/security-alerts/cpuapr2022.html
https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1327
Published: 2019-04-10T20:12:30
Last Modified: 2024-08-05T03:07:17.918Z
Copied to clipboard!