PT-2019-11826 · Jenkins · Jenkins Html Publisher Plugin+1

Viktor Gazdag · CVE-2019-10432 · Published 2019-10-01 · Updated 2023-10-25

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins HTML Publisher Plugin versions 1.20 and earlier

Description The issue results from the failure to escape project and build display names in the HTML report frame, leading to a cross-site scripting vulnerability. This vulnerability can be exploited by users who have the ability to change these names.

Recommendations For Jenkins HTML Publisher Plugin versions 1.20 and earlier, update to version 1.21 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-10432

GHSA-Q829-HRMC-84C8

RHSA-2019:4055

RHSA-2019:4089

RHSA-2019:4097

Affected Products

Jenkins

Jenkins Html Publisher Plugin

References · 11

• https://access.redhat.com/errata/RHSA-2019:4055 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:4089 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10432 · Security Note
• https://access.redhat.com/errata/RHSA-2019:4097 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10432 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q829-hrmc-84c8 · Vendor Advisory
• https://github.com/jenkinsci/htmlpublisher-plugin · Note
• https://github.com/jenkinsci/htmlpublisher-plugin/commit/637aad0308f8cdfb24610041fcfe815d5a1a096b · Note
• https://github.com/jenkinsci/htmlpublisher-plugin/releases/tag/htmlpublisher-1.21 · Note
• http://openwall.com/lists/oss-security/2019/10/01/2 · Note