CVE-2019-1003014: XSS
First published: Wed Feb 06 2019(Updated: )
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Config File Provider | <=3.4.1 | |
| Redhat Openshift Container Platform | =3.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-1003014?
The severity of CVE-2019-1003014 is medium with a CVSS score of 4.8.
What is the affected software of CVE-2019-1003014?
The affected software of CVE-2019-1003014 is Jenkins Config File Provider Plugin 3.4.1 and earlier, as well as Redhat Openshift Container Platform 3.11.
How can an attacker exploit CVE-2019-1003014?
Attackers with permission to define shared configuration files can exploit CVE-2019-1003014 by executing arbitrary JavaScript when a user attempts to delete the configuration file.
Where can I find more information about CVE-2019-1003014?
You can find more information about CVE-2019-1003014 from the following references: [Red Hat Advisory](https://access.redhat.com/errata/RHBA-2019:0326), [Red Hat Advisory](https://access.redhat.com/errata/RHBA-2019:0327), [Jenkins Security Advisory](https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1253).
What is the Common Weakness Enumeration (CWE) of CVE-2019-1003014?
The Common Weakness Enumeration (CWE) of CVE-2019-1003014 is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
- collector/nvd-index
- collector/nvd-api
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/jenkins
- canonical/jenkins config file provider
- version/jenkins config file provider/3.4.1
- vendor/redhat
- canonical/redhat openshift container platform
- version/redhat openshift container platform/3.11