PT-2019-11778 · Cloudbees+1 · Jenkins

Published 2019-08-28 · Updated 2023-10-25 · CVE-2019-10383

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.191 and earlier Jenkins LTS versions 2.176.2 and earlier

Description A stored cross-site scripting issue allows attackers with Overall/Administer permission to inject arbitrary HTML and JavaScript in update center web pages by configuring the update site URL.

Recommendations For Jenkins versions 2.191 and earlier, update to a version later than 2.191 to resolve the issue. For Jenkins LTS versions 2.176.2 and earlier, update to a version later than 2.176.2 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10383

GHSA-9M48-54PJ-H248

RHSA-2019:2789

RHSA-2019:3144

Affected Products

Jenkins

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2019-10383 · Security Note
• https://oracle.com/security-alerts/cpuapr2022.html · Patch
• https://access.redhat.com/errata/RHSA-2019:2789 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1453 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9m48-54pj-h248 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3144 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10383 · Vendor Advisory
• https://github.com/jenkinsci/jenkins/commit/fb88530f77d38660ab2aae8c2e842944f0fb1507 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10383 · Note
• http://openwall.com/lists/oss-security/2019/08/28/4 · Note