PT-2019-11769 · Jenkins · Jenkins Pipeline: Build Step Plugin+1

Daniel Beck · CVE-2019-10373 · Publicado 2019-08-07 · Atualizado 2023-10-25

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Build Pipeline Plugin versions 1.5.8 and earlier

Description A stored cross-site scripting issue allows attackers who can edit the build pipeline description to inject arbitrary HTML and JavaScript into the plugin-provided web pages in Jenkins. The issue arises because the Build Pipeline Plugin does not properly escape variables in views. This vulnerability is only exploitable on Jenkins releases older than 2.146 or 2.138.2 due to security hardening implemented in those releases.

Recommendations For Jenkins Build Pipeline Plugin versions 1.5.8 and earlier, as a temporary workaround, consider restricting access to configure build pipelines to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-10373

GHSA-CX5R-P4VJ-2MQH

Produtos afetados

Jenkins

Jenkins Pipeline: Build Step Plugin

Referências · 5

• https://osv.dev/vulnerability/GHSA-cx5r-p4vj-2mqh · Aviso do Fabricante
• https://jenkins.io/security/advisory/2019-08-07/#SECURITY-879 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10373 · Nota de Segurança
• http://openwall.com/lists/oss-security/2019/08/07/1 · Nota
• https://osv.dev/vulnerability/CVE-2019-10373 · Aviso do Fabricante