Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1odzU1LWY4d2MtODJtNs4AAq6O

Improper Neutralization of Input During Web Page Generation in Jenkins

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.

Permalink: https://github.com/advisories/GHSA-hw55-f8wc-82m6
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1odzU1LWY4d2MtODJtNs4AAq6O
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago

CVSS Score: 4.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-hw55-f8wc-82m6, CVE-2019-10406
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-10406
• https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1471
• http://www.openwall.com/lists/oss-security/2019/09/25/3
• https://github.com/jenkinsci/jenkins/commit/e2c596c049e5e09e7254ff000802709c2e01af2a
• https://github.com/advisories/GHSA-hw55-f8wc-82m6

Repository: https://github.com/jenkinsci/jenkins
Blast Radius: 1.0

Affected Packages