PT-2019-11311 · Jenkins · Jenkins Blue Ocean Plugin+1

Man Shum · Published 2019-02-06 · Updated 2023-10-25 · CVE-2019-1003013

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Blue Ocean Plugins versions 1.10.1 and earlier

Description: A cross-site scripting issue exists that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user. The vulnerability is found in several files, including Export.java, ExportConfig.java, JSONDataWriter.java, UserStatePreloader.java, and header.jelly.

Recommendations: For Jenkins Blue Ocean Plugins versions 1.10.1 and earlier, consider disabling the editing of user descriptions in Jenkins until a patch is available. Restrict access to the Blue Ocean plugin to minimize the risk of exploitation. Avoid using the Blue Ocean plugin with users who have permission to edit descriptions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-1003013

GHSA-7FJR-5HPH-C2MH

Affected Products

Jenkins

Jenkins Blue Ocean Plugin

References · 7

• https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1003013 · Security Note
• https://osv.dev/vulnerability/GHSA-7fjr-5hph-c2mh · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:0327 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2019:0326 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1003013 · Vendor Advisory
• https://github.com/jenkinsci/blueocean-plugin/commit/62775e78532b756826bb237775b64a5052624b57 · Note