Cross-Site Scripting Vulnerability in Jenkins Dashboard View Plugin
CVE-2019-10396

5.4MEDIUM

Key Information:

Vendor
Jenkins
Status
Jenkins Dashboard View Plugin
Vendor
CVE Published:
12 September 2019

Summary

The Jenkins Dashboard View Plugin versions 2.11 and earlier have a vulnerability due to improper handling of build descriptions. This lack of escaping allows users with permission to change build descriptions to inject malicious scripts into the output, potentially compromising the security of applications and users accessing the Jenkins interface.

Affected Version(s)

Jenkins Dashboard View Plugin 2.11 and earlier

References

http://www.openwall.com/lists/oss-security/2019/09/12/2
mailing-listx_refsource_MLIST
https://jenkins.io/security/advisory/2019-09-12/#SECURITY...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.