PT-2019-11321 · Jenkins · Jenkins Warnings Next Generation Plugin+1

Kalle Niemitalo · Publicado 2019-02-06 · Atualizado 2023-10-25 · CVE-2019-1003023

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Warnings Next Generation Plugin versions 1.0.1 and earlier

Description: A cross-site scripting issue exists that allows attackers with the ability to control warnings parser input to have Jenkins render arbitrary HTML. This is due to vulnerabilities in several Java files, including DetailsTableModel.java, SourceDetail.java, SourcePrinter.java, Sanitizer.java, and DuplicateCodeScanner.java.

Recommendations: For Jenkins Warnings Next Generation Plugin versions 1.0.1 and earlier, consider disabling the plugin until a patch is available to prevent potential exploitation. Restrict access to the warnings parser input to minimize the risk of arbitrary HTML rendering.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-1003023

GHSA-CQP7-HWM3-CFG7

Produtos afetados

Jenkins

Jenkins Warnings Next Generation Plugin

Referências · 4

• https://osv.dev/vulnerability/GHSA-cqp7-hwm3-cfg7 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1003023 · Nota de Segurança
• https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1271 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1003023 · Aviso do Fabricante