PT-2019-11769 · Jenkins · Jenkins Pipeline: Build Step Plugin+1

Daniel Beck · Published 2019-08-07 · Updated 2023-10-25 · CVE-2019-10373

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Build Pipeline Plugin versions 1.5.8 and earlier

Description A stored cross-site scripting issue allows attackers who can edit the build pipeline description to inject arbitrary HTML and JavaScript into the plugin-provided web pages in Jenkins. The issue arises because the Build Pipeline Plugin does not properly escape variables in views. This vulnerability is only exploitable on Jenkins releases older than 2.146 or 2.138.2 due to security hardening implemented in those releases.

Recommendations For Jenkins Build Pipeline Plugin versions 1.5.8 and earlier, as a temporary workaround, consider restricting access to configure build pipelines to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10373

GHSA-CX5R-P4VJ-2MQH

Affected Products

Jenkins

Jenkins Pipeline: Build Step Plugin

References · 5

• https://osv.dev/vulnerability/GHSA-cx5r-p4vj-2mqh · Vendor Advisory
• https://jenkins.io/security/advisory/2019-08-07/#SECURITY-879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10373 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10373 · Vendor Advisory
• http://openwall.com/lists/oss-security/2019/08/07/1 · Note