PT-2019-11789 · Cloudbees+1 · Jenkins+1

Viktor Gazdag · Published 2019-09-12 · Updated 2023-10-25 · CVE-2019-10395

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.146 Jenkins Build Environment Plugin versions 1.6 and earlier

Description The issue is related to a cross-site scripting vulnerability. It occurs because the Jenkins Build Environment Plugin did not properly escape variables shown on its views. This vulnerability can be exploited by users who have the ability to change various job or build properties, typically those with Job/Configure or Job/Build permission. The vulnerability allows attackers to control the values of build environment variables.

Recommendations For Jenkins versions prior to 2.146, update to version 2.146 or newer to resolve the issue. For Jenkins Build Environment Plugin versions 1.6 and earlier, update to a version that escapes all variables displayed in its views to mitigate the risk of cross-site scripting exploitation. As a temporary workaround, consider restricting access to the build environment variables and views to minimize the risk of exploitation until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10395

GHSA-88QJ-3Q6H-8M5Q

Affected Products

Jenkins

Jenkins Build Environment Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-10395 · Security Note
• https://osv.dev/vulnerability/GHSA-88qj-3q6h-8m5q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10395 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1476 · Vendor Advisory
• https://github.com/jenkinsci/build-environment-plugin/commit/c9797608e839d0dce1957e3c1b512b872839e603 · Note
• http://openwall.com/lists/oss-security/2019/09/12/2 · Note