PT-2019-2580 · Jenkins · Jenkins Lockable Resources Plugin+1

Jesper Den Boer · Publicado 2019-03-25 · Atualizado 2023-10-25 · CVE-2019-1003042

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Lockable Resources Plugin versions 2.4 and earlier

Description The issue allows attackers to inject arbitrary JavaScript code in web pages rendered by the plugin due to a cross-site scripting vulnerability. This can be exploited by attackers who can control resource names, potentially allowing a remote attacker to inject arbitrary JavaScript code into web pages displayed by the plugin.

Recommendations For Jenkins Lockable Resources Plugin versions 2.4 and earlier, consider updating to a version later than 2.4 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-02455

CVE-2019-1003042

GHSA-WQJJ-C9CX-Q7CF

RHSA-2019:1423

Produtos afetados

Jenkins

Jenkins Lockable Resources Plugin

Referências · 11

• https://github.com/jenkinsci/lockable-resources-plugin/commit/4f401e250eb9e865e951b069255fea7052423739 · Nota
• https://github.com/jenkinsci/lockable-resources-plugin · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-1003042 · Nota de Segurança
• https://bdu.fstec.ru/vul/2019-02455 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2019:1423 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1361 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2019-03-25 · Nota
• https://osv.dev/vulnerability/GHSA-wqjj-c9cx-q7cf · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/03/28/2 · Nota
• https://osv.dev/vulnerability/CVE-2019-1003042 · Aviso do Fabricante
• http://securityfocus.com/bid/107628 · Nota