PT-2019-11790 · Jenkins · Jenkins Dashboard View Plugin+1

Viktor Gazdag · Published 2019-09-12 · Updated 2023-10-25 · CVE-2019-10396

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Dashboard View Plugin versions 2.11 and earlier

Description The issue is related to a cross-site scripting vulnerability. It occurs because build descriptions are not properly escaped, allowing attackers who can change build descriptions to exploit this weakness. The vulnerability is exploitable by users able to control the description of builds shown on the Latest Builds View.

Recommendations For Jenkins Dashboard View Plugin versions 2.11 and earlier, update the plugin to apply the configured markup formatter to the build description, rendering it as it appears elsewhere in Jenkins, to prevent cross-site scripting exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10396

GHSA-FV4Q-4H24-23QR

Affected Products

Jenkins

Jenkins Dashboard View Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2019-10396 · Security Note
• https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1489 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fv4q-4h24-23qr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10396 · Vendor Advisory
• https://github.com/jenkinsci/dashboard-view-plugin/commit/115238da2a8899358b32ee14e7076df23747d6c9 · Note
• http://openwall.com/lists/oss-security/2019/09/12/2 · Note