PT-2019-11826 · Jenkins · Jenkins Html Publisher Plugin+1

Viktor Gazdag · CVE-2019-10432 · Publicado 2019-10-01 · Atualizado 2023-10-25

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins HTML Publisher Plugin versions 1.20 and earlier

Description The issue results from the failure to escape project and build display names in the HTML report frame, leading to a cross-site scripting vulnerability. This vulnerability can be exploited by users who have the ability to change these names.

Recommendations For Jenkins HTML Publisher Plugin versions 1.20 and earlier, update to version 1.21 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-10432

GHSA-Q829-HRMC-84C8

RHSA-2019:4055

RHSA-2019:4089

RHSA-2019:4097

Produtos afetados

Jenkins

Jenkins Html Publisher Plugin

Referências · 11

• https://github.com/jenkinsci/htmlpublisher-plugin · Nota
• https://github.com/jenkinsci/htmlpublisher-plugin/commit/637aad0308f8cdfb24610041fcfe815d5a1a096b · Nota
• https://github.com/jenkinsci/htmlpublisher-plugin/releases/tag/htmlpublisher-1.21 · Nota
• http://openwall.com/lists/oss-security/2019/10/01/2 · Nota
• https://access.redhat.com/errata/RHSA-2019:4055 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:4089 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1590 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10432 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2019:4097 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-10432 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-q829-hrmc-84c8 · Aviso do Fabricante