GitHub Advisoryadvisory · Maven

GHSA-w3pj-v9jr-v2wc Jenkins ElectricFlow Plugin is vulnerable to reflected cross site scripting vulnerability

MEDIUM Published 2022-05-24 Modified 2023-10-26 Official page ↗
Aliases
CVE-2019-10336
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:electricflow
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-10-26

Affected packages

• Maven org.jenkins-ci.plugins:electricflow: < 1.1.7 → fixed in 1.1.7

Description

The configuration forms of various post-build steps contributed by CloudBees CD Plugin were vulnerable to cross-site scripting. This allowed attackers able to control the output of connected ElectricFlow servers' APIs to inject arbitrary HTML and JavaScript into the configuration form. CloudBees CD Plugin no longer interprets HTML/JavaScript in responses from ElectricFlow server APIs on job configuration forms.

Related

Alias · CVE (1)

  • CVE-2019-10336 A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References