Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS00d2o3LXJoNWgtNXFtcs4AAhRC

Jenkins Dependency Graph Viewer Plugin contains Cross-site Scripting

A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.

Permalink: https://github.com/advisories/GHSA-4wj7-rh5h-5qmr
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS00d2o3LXJoNWgtNXFtcs4AAhRC
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: 7 months ago

CVSS Score: 5.4
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-4wj7-rh5h-5qmr, CVE-2019-10349
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-10349
• https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1177
• http://www.openwall.com/lists/oss-security/2019/07/11/4
• http://packetstormsecurity.com/files/153610/Jenkins-Dependency-Graph-View-0.13-Cross-Site-Scripting.html
• http://www.securityfocus.com/bid/109156
• https://github.com/jenkinsci/depgraph-view-plugin/commit/288496fd2e6fe922da3b43067e73cfac07a910e8
• https://github.com/advisories/GHSA-4wj7-rh5h-5qmr

Repository: https://github.com/jenkinsci/depgraph-view-plugin
Blast Radius: 1.0

Affected Packages