CVE-2019-10410
UNKNOWN
Published 2019-09-25T15:05:32
Actions:
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2019-10410. We'll provide specific mitigation strategies based on your environment and risk profile.
No CVSS data available
Description
Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by users able to define log parsing rules.
Available Exploits
No exploits available for this CVE.
Related News
No news articles found for this CVE.
Affected Products
Affected Versions:
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
✓ GitHub Reviewed
MODERATE
Jenkins Log Parser Plugin vulnerable to Cross-site Scripting
GHSA-xqqw-cqjp-52xmAdvisory Details
Log Parser Plugin did not escape an error message shown when log parsing patterns are invalid. This resulted in a persisted cross-site scripting vulnerability exploitable by attackers able to control the log parsing rules configuration, typically users with Job/Configure permission.
Jenkins applies the missing escaping by default since 2.146 and LTS 2.138.2, so newer Jenkins releases are not affected by this vulnerability.
Log Parser Plugin version 2.1 escapes all variables displayed in its views.
Affected Packages
Maven
org.jenkins-ci.plugins:log-parser
ECOSYSTEM:
≥0
<2.1
CVSS Scoring
CVSS Score
5.0
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
Advisory provided by GitHub Security Advisory Database. Published: May 24, 2022, Modified: February 23, 2023
References
Published: 2019-09-25T15:05:32
Last Modified: 2024-08-04T22:24:16.967Z
Copied to clipboard!