Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS03ZmpyLTVocGgtYzJtaM4AAQ7u

Cross-site Scripting in Jenkins Blue Ocean Plugin

A cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.
This vulnerability is found in:

• blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java
• blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java
• blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java
• blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java
• blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly

Permalink: https://github.com/advisories/GHSA-7fjr-5hph-c2mh
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03ZmpyLTVocGgtYzJtaM4AAQ7u
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 5 months ago

CVSS Score: 5.4
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-7fjr-5hph-c2mh, CVE-2019-1003013
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-1003013
• https://access.redhat.com/errata/RHBA-2019:0326
• https://access.redhat.com/errata/RHBA-2019:0327
• https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1204
• https://github.com/jenkinsci/blueocean-plugin/commit/62775e78532b756826bb237775b64a5052624b57
• https://github.com/advisories/GHSA-7fjr-5hph-c2mh

Repository: https://github.com/jenkinsci/blueocean-plugin
Blast Radius: 1.0

Affected Packages