PT-2019-11778 · Cloudbees+1 · Jenkins

CVE-2019-10383 · Publicado 2019-08-28 · Atualizado 2023-10-25

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.191 and earlier Jenkins LTS versions 2.176.2 and earlier

Description A stored cross-site scripting issue allows attackers with Overall/Administer permission to inject arbitrary HTML and JavaScript in update center web pages by configuring the update site URL.

Recommendations For Jenkins versions 2.191 and earlier, update to a version later than 2.191 to resolve the issue. For Jenkins LTS versions 2.176.2 and earlier, update to a version later than 2.176.2 to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-10383

GHSA-9M48-54PJ-H248

RHSA-2019:2789

RHSA-2019:3144

Produtos afetados

Jenkins

Referências · 10

• https://github.com/jenkinsci/jenkins/commit/fb88530f77d38660ab2aae8c2e842944f0fb1507 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10383 · Nota de Segurança
• https://oracle.com/security-alerts/cpuapr2022.html · Correção
• https://access.redhat.com/errata/RHSA-2019:2789 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1453 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-9m48-54pj-h248 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:3144 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10383 · Nota
• https://osv.dev/vulnerability/CVE-2019-10383 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/08/28/4 · Nota