Impact: Moderate Public Date: 2019-04-10 CWE: CWE-79 Bugzilla: 1699333: CVE-2019-1003050 jenkins: Improper escaping of job URLs in f:validateButton leads to cross-site scripting vulnerability. The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2019-1003050 from the MITRE CVE dictionary dictionary and NIST NVD.
NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.
CVSS3 Base Score | 5.4 |
---|---|
CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Attack Vector | Network |
Attack Complexity | Low |
Privileges Required | Low |
User Interaction | Required |
Scope | Changed |
Confidentiality | Low |
Integrity Impact | Low |
Availability Impact | None |
Platform | Package | State |
---|---|---|
Red Hat OpenShift Container Platform 3.9 | jenkins | Under investigation |
Red Hat OpenShift Container Platform 3.7 | jenkins | Under investigation |
Red Hat OpenShift Container Platform 3.6 | jenkins | Under investigation |
Red Hat OpenShift Container Platform 3.5 | jenkins | Under investigation |
Red Hat OpenShift Container Platform 3.4 | jenkins | Under investigation |
Red Hat OpenShift Container Platform 3.11 | jenkins | Under investigation |
Red Hat OpenShift Container Platform 3.10 | jenkins | Under investigation |