PT-2019-2580 · Jenkins · Jenkins Lockable Resources Plugin+1

Jesper Den Boer · Published 2019-03-25 · Updated 2023-10-25 · CVE-2019-1003042

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Lockable Resources Plugin versions 2.4 and earlier

Description The issue allows attackers to inject arbitrary JavaScript code in web pages rendered by the plugin due to a cross-site scripting vulnerability. This can be exploited by attackers who can control resource names, potentially allowing a remote attacker to inject arbitrary JavaScript code into web pages displayed by the plugin.

Recommendations For Jenkins Lockable Resources Plugin versions 2.4 and earlier, consider updating to a version later than 2.4 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-02455

CVE-2019-1003042

GHSA-WQJJ-C9CX-Q7CF

RHSA-2019:1423

Affected Products

Jenkins

Jenkins Lockable Resources Plugin

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2019-1003042 · Security Note
• https://bdu.fstec.ru/vul/2019-02455 · Security Note
• https://access.redhat.com/errata/RHSA-2019:1423 · Vendor Advisory
• https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1361 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wqjj-c9cx-q7cf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-1003042 · Vendor Advisory
• https://github.com/jenkinsci/lockable-resources-plugin/commit/4f401e250eb9e865e951b069255fea7052423739 · Note
• https://github.com/jenkinsci/lockable-resources-plugin · Note
• https://jenkins.io/security/advisory/2019-03-25 · Note
• http://openwall.com/lists/oss-security/2019/03/28/2 · Note
• http://securityfocus.com/bid/107628 · Note