PT-2019-11770 · Jenkins · Jenkins Pegdown Formatter Plugin+1

David Fiser · Published 2019-08-07 · Updated 2023-10-25 · CVE-2019-10374

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins PegDown Formatter Plugin versions 1.3 and earlier

Description A stored cross-site scripting issue allows attackers who can edit descriptions and other fields to insert links with the javascript: scheme into the Jenkins UI. The PegDown Formatter Plugin uses the PegDown library to render Markdown formatted descriptions and advertises disabling of HTML to prevent cross-site scripting, but it does not prevent the use of the javascript: scheme in URLs for links. This results in an exploitable issue by users able to configure entities with descriptions that are rendered by the configured markup formatter.

Recommendations For Jenkins PegDown Formatter Plugin versions 1.3 and earlier, as a temporary workaround, consider disabling the plugin until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the plugin to render descriptions or similar properties that could be used to insert malicious links. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10374

GHSA-922H-X9QV-2274

Affected Products

Jenkins

Jenkins Pegdown Formatter Plugin

References · 6

• https://osv.dev/vulnerability/GHSA-922h-x9qv-2274 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10374 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10374 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-08-07/#SECURITY-142 · Vendor Advisory
• https://github.com/jenkinsci/pegdown-formatter-plugin · Note
• http://openwall.com/lists/oss-security/2019/08/07/1 · Note