CVE-2019-1003050: XSS
The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-1003050?
CVE-2019-1003050 is a cross-site scripting (XSS) vulnerability in Jenkins that allows users with the ability to control job names to exploit it.
What is the severity of CVE-2019-1003050?
The severity of CVE-2019-1003050 is medium with a CVSS score of 5.4.
Which software versions are affected by CVE-2019-1003050?
CVE-2019-1003050 affects Jenkins versions up to 2.171 and Jenkins LTS versions up to 2.164.1.
How can I fix CVE-2019-1003050 in Jenkins?
To fix CVE-2019-1003050 in Jenkins, upgrade to version 2.172 or higher for Jenkins releases, or version 2.164.2 or higher for Jenkins LTS releases.
Where can I find more information about CVE-2019-1003050?
You can find more information about CVE-2019-1003050 on the SecurityFocus, Red Hat, and Jenkins websites.