GitHub Advisoryadvisory · Maven

GHSA-9m48-54pj-h248 Improper Neutralization of Input During Web Page Generation in Jenkins

MEDIUM Published 2022-05-24 Modified 2022-06-28 Official page ↗
Aliases
CVE-2019-10383
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-06-28

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.176.3 → fixed in 2.176.3 • Maven org.jenkins-ci.main:jenkins-core: >= 2.177, < 2.192 → fixed in 2.192

Description

A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.

Related

Alias · CVE (1)

  • CVE-2019-10383 A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References