PT-2019-11804 · Jenkins · Jenkins Log Parser Plugin+1

Wadeck Follonier · Published 2019-09-25 · Updated 2023-10-25 · CVE-2019-10410

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Log Parser Plugin versions 2.0 and earlier

Description The issue is related to a cross-site scripting vulnerability. It occurs because an error message is not properly escaped, allowing exploitation by users who can define log parsing rules. This vulnerability is exploitable by attackers who can control the log parsing rules configuration, typically those with Job/Configure permission. The vulnerability results in a persisted cross-site scripting issue when log parsing patterns are invalid.

Recommendations For Jenkins Log Parser Plugin versions 2.0 and earlier, update to version 2.1 or later, which escapes all variables displayed in its views. As a temporary workaround, consider restricting access to define log parsing rules to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10410

GHSA-XQQW-CQJP-52XM

Affected Products

Jenkins

Jenkins Log Parser Plugin

References · 6

• https://jenkins.io/security/advisory/2019-09-25/#SECURITY-732 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10410 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10410 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xqqw-cqjp-52xm · Vendor Advisory
• https://github.com/jenkinsci/log-parser-plugin · Note
• http://openwall.com/lists/oss-security/2019/09/25/3 · Note