CVE-2019-10335: XSS
A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jenkins or control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in the plugin-provided output on build status pages.
Other sources
The plugin adds metadata displayed on build pages during its operations.
Any user content was not escaped, resulting in a cross-site scripting vulnerability allowing users with Job/Configure permission, or attackers controlling API responses received from ElectricFlow to render arbitrary HTML and JavaScript on Jenkins build pages.
Build metadata is now filtered through a HTML formatter that only allows showing basic HTML, neutralizing any unsafe data. Additionally, all builds executed after the security update is applied will now properly escape content received from ElectricFlow.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10335?
CVE-2019-10335 is a stored cross site scripting vulnerability in the Jenkins ElectricFlow Plugin 1.1.5 and earlier.
What is the severity of CVE-2019-10335?
The severity of CVE-2019-10335 is medium, with a CVSS score of 5.4.
How does CVE-2019-10335 impact Jenkins ElectricFlow Plugin?
CVE-2019-10335 allows users with Job/Configure permission or attackers controlling API responses from ElectricFlow to render arbitrary HTML and execute malicious scripts.
What is the Common Weakness Enumeration (CWE) ID of CVE-2019-10335?
The CWE ID of CVE-2019-10335 is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation (Cross-site Scripting).
How can I fix the vulnerability in Jenkins ElectricFlow Plugin?
To fix the vulnerability, you should upgrade to Jenkins ElectricFlow Plugin version 1.1.6 or later.