GitHub Advisoryadvisory · Maven

GHSA-88qj-3q6h-8m5q Jenkins Build Environment Plugin vulnerable to Cross-site Scripting

MEDIUM Published 2022-05-24 Modified 2023-03-02 Official page ↗
Aliases
CVE-2019-10395
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:build-environment
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-03-02

Affected packages

• Maven org.jenkins-ci.plugins:build-environment: < 1.7 → fixed in 1.7

Description

Build Environment Plugin did not escape values of environment variables shown on its views. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the values of build environment variables, typically users with Job/Configure or Job/Build permission. Jenkins applies the missing escaping by default since 2.146 and LTS 2.138.2, so newer Jenkins releases are not affected by this vulnerability. Build Environment Plugin now escapes all variables displayed in its views.

Related

Alias · CVE (1)

  • CVE-2019-10395 Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References