CVE-2019-1003014: XSS
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1003014?
The severity of CVE-2019-1003014 is medium with a CVSS score of 4.8.
What is the affected software of CVE-2019-1003014?
The affected software of CVE-2019-1003014 is Jenkins Config File Provider Plugin 3.4.1 and earlier, as well as Redhat Openshift Container Platform 3.11.
How can an attacker exploit CVE-2019-1003014?
Attackers with permission to define shared configuration files can exploit CVE-2019-1003014 by executing arbitrary JavaScript when a user attempts to delete the configuration file.
Where can I find more information about CVE-2019-1003014?
You can find more information about CVE-2019-1003014 from the following references: [Red Hat Advisory](https://access.redhat.com/errata/RHBA-2019:0326), [Red Hat Advisory](https://access.redhat.com/errata/RHBA-2019:0327), [Jenkins Security Advisory](https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1253).
What is the Common Weakness Enumeration (CWE) of CVE-2019-1003014?
The Common Weakness Enumeration (CWE) of CVE-2019-1003014 is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').