PT-2019-11770 · Jenkins · Jenkins Pegdown Formatter Plugin+1

David Fiser · Publicado 2019-08-07 · Atualizado 2023-10-25 · CVE-2019-10374

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins PegDown Formatter Plugin versions 1.3 and earlier

Description A stored cross-site scripting issue allows attackers who can edit descriptions and other fields to insert links with the javascript: scheme into the Jenkins UI. The PegDown Formatter Plugin uses the PegDown library to render Markdown formatted descriptions and advertises disabling of HTML to prevent cross-site scripting, but it does not prevent the use of the javascript: scheme in URLs for links. This results in an exploitable issue by users able to configure entities with descriptions that are rendered by the configured markup formatter.

Recommendations For Jenkins PegDown Formatter Plugin versions 1.3 and earlier, as a temporary workaround, consider disabling the plugin until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the plugin to render descriptions or similar properties that could be used to insert malicious links. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-10374

GHSA-922H-X9QV-2274

Produtos afetados

Jenkins

Jenkins Pegdown Formatter Plugin

Referências · 6

• https://github.com/jenkinsci/pegdown-formatter-plugin · Nota
• https://osv.dev/vulnerability/GHSA-922h-x9qv-2274 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10374 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-10374 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/08/07/1 · Nota
• https://jenkins.io/security/advisory/2019-08-07/#SECURITY-142 · Aviso do Fabricante