GitHub Advisoryadvisory · Maven

GHSA-xqqw-cqjp-52xm Jenkins Log Parser Plugin vulnerable to Cross-site Scripting

MEDIUM Published 2022-05-24 Modified 2023-02-23 Official page ↗
Aliases
CVE-2019-10410
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:log-parser
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-02-23

Affected packages

• Maven org.jenkins-ci.plugins:log-parser: < 2.1 → fixed in 2.1

Description

Log Parser Plugin did not escape an error message shown when log parsing patterns are invalid. This resulted in a persisted cross-site scripting vulnerability exploitable by attackers able to control the log parsing rules configuration, typically users with Job/Configure permission. Jenkins applies the missing escaping by default since 2.146 and LTS 2.138.2, so newer Jenkins releases are not affected by this vulnerability. Log Parser Plugin version 2.1 escapes all variables displayed in its views.

Related

Alias · CVE (1)

  • CVE-2019-10410 Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References