GitHub Advisoryadvisory · Maven
GHSA-4wj7-rh5h-5qmr Jenkins Dependency Graph Viewer Plugin contains Cross-site Scripting
MEDIUM
Official page ↗
- Aliases
- CVE-2019-10349
- Ecosystem
- Maven
- Packages
- org.jenkins-ci.plugins:depgraph-view
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2023-02-01
Affected packages
• Maven org.jenkins-ci.plugins:depgraph-view: < 0.14 → fixed in 0.14
Description
A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
Related
Alias · CVE (1)
- CVE-2019-10349 A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure… vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10349 advisory
- https://github.com/jenkinsci/depgraph-view-plugin/commit/288496fd2e6fe922da3b43067e73cfac07a910e8 web
- https://github.com/jenkinsci/depgraph-view-plugin package
- https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1177 web
- http://packetstormsecurity.com/files/153610/Jenkins-Dependency-Graph-View-0.13-Cross-Site-Scripting.html web
- http://www.openwall.com/lists/oss-security/2019/07/11/4 web
- http://www.securityfocus.com/bid/109156 web