PT-2019-11321 · Jenkins · Jenkins Warnings Next Generation Plugin+1

Kalle Niemitalo · Published 2019-02-06 · Updated 2023-10-25 · CVE-2019-1003023

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Jenkins Warnings Next Generation Plugin versions 1.0.1 and earlier

Description: A cross-site scripting issue exists that allows attackers with the ability to control warnings parser input to have Jenkins render arbitrary HTML. This is due to vulnerabilities in several Java files, including DetailsTableModel.java, SourceDetail.java, SourcePrinter.java, Sanitizer.java, and DuplicateCodeScanner.java.

Recommendations: For Jenkins Warnings Next Generation Plugin versions 1.0.1 and earlier, consider disabling the plugin until a patch is available to prevent potential exploitation. Restrict access to the warnings parser input to minimize the risk of arbitrary HTML rendering.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-1003023

GHSA-CQP7-HWM3-CFG7

Affected Products

Jenkins

Jenkins Warnings Next Generation Plugin

References · 4

• https://osv.dev/vulnerability/GHSA-cqp7-hwm3-cfg7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1003023 · Security Note
• https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1271 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1003023 · Vendor Advisory