GitHub Advisoryadvisory · Maven

GHSA-fv4q-4h24-23qr Jenkins Dashboard View Plugin vulnerable to Cross-site Scripting

MEDIUM Published 2022-05-24 Modified 2023-03-02 Official page ↗
Aliases
CVE-2019-10396
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:dashboard-view
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-03-02

Affected packages

• Maven org.jenkins-ci.plugins:dashboard-view: < 2.12 → fixed in 2.12

Description

Dashboard View Plugin did not escape the build description on the Latest Builds View. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the description of builds shown on that view. Dashboard View Plugin now applies the configured markup formatter to the build description, rendering it as it appears elsewhere in Jenkins.

Related

Alias · CVE (1)

  • CVE-2019-10396 Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References