CVE-2019-1003013: XSS
A cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user. This vulnerability is found in: - blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java - blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java - blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java - blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java - blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly
Other sources
An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-1003013?
CVE-2019-1003013 is a cross-site scripting vulnerability in Jenkins Blue Ocean Plugins 1.10.1 and earlier.
How severe is CVE-2019-1003013?
CVE-2019-1003013 has a severity rating of 5.4, which is considered medium.
What software is affected by CVE-2019-1003013?
Jenkins Blue Ocean Plugins 1.10.1 and earlier as well as Redhat Openshift Container Platform 3.11 are affected by CVE-2019-1003013.
How can I fix CVE-2019-1003013?
To fix CVE-2019-1003013, upgrade to a version of Jenkins Blue Ocean Plugins that is later than 1.10.1.
Where can I find more information about CVE-2019-1003013?
You can find more information about CVE-2019-1003013 at the following references: [1] [2] [3].