PT-2019-11797 · Cloudbees+1 · Jenkins

Wadeck Follonier · CVE-2019-10403 · Publicado 2019-09-25 · Atualizado 2023-11-02

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.196 and earlier Jenkins LTS versions 2.176.3 and earlier

Description The issue results from the failure to escape the SCM tag name on the tooltip for SCM tag actions, leading to a stored XSS vulnerability. This can be exploited by users who have control over SCM tag names for these actions.

Recommendations For Jenkins versions 2.196 and earlier, update to a version that includes the fix for this issue. For Jenkins LTS versions 2.176.3 and earlier, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to SCM tag actions to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-10403

GHSA-7CJC-XPPR-XJ6X

Produtos afetados

Jenkins

Referências · 7

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10403 · Nota
• http://openwall.com/lists/oss-security/2019/09/25/3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-10403 · Nota de Segurança
• https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1537%20(1) · Nota
• https://osv.dev/vulnerability/GHSA-7cjc-xppr-xj6x · Aviso do Fabricante
• https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1537%20%281%29 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10403 · Aviso do Fabricante