CVE-2019-10335: XSS
First published: Tue Jun 11 2019(Updated: )
A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jenkins or control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in the plugin-provided output on build status pages.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Electricflow | <=1.1.6 | |
| maven/org.jenkins-ci.plugins:electricflow | <=1.1.6 | 1.1.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2019/06/11/1
- http://www.securityfocus.com/bid/108747
- https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1412
- https://nvd.nist.gov/vuln/detail/CVE-2019-10335
- https://web.archive.org/web/20200227033720/http://www.securityfocus.com/bid/108747
- https://github.com/jenkinsci/electricflow-plugin/commit/1a90ee7727f8c6925df3e410837ddf6be28cce53
- https://github.com/advisories/GHSA-fx9p-2qvx-pgjv (Advisory)
Frequently Asked Questions
What is CVE-2019-10335?
CVE-2019-10335 is a stored cross site scripting vulnerability in the Jenkins ElectricFlow Plugin 1.1.5 and earlier.
What is the severity of CVE-2019-10335?
The severity of CVE-2019-10335 is medium, with a CVSS score of 5.4.
How does CVE-2019-10335 impact Jenkins ElectricFlow Plugin?
CVE-2019-10335 allows users with Job/Configure permission or attackers controlling API responses from ElectricFlow to render arbitrary HTML and execute malicious scripts.
What is the Common Weakness Enumeration (CWE) ID of CVE-2019-10335?
The CWE ID of CVE-2019-10335 is CWE-79, which refers to Improper Neutralization of Input During Web Page Generation (Cross-site Scripting).
How can I fix the vulnerability in Jenkins ElectricFlow Plugin?
To fix the vulnerability, you should upgrade to Jenkins ElectricFlow Plugin version 1.1.6 or later.
- collector/nvd-index
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-fx9p-2qvx-pgjv
- alias/CVE-2019-10335
- collector/github-advisory
- agent/severity
- agent/author
- agent/type
- agent/event
- agent/weakness
- agent/references
- agent/description
- agent/tags
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- vendor/jenkins
- canonical/jenkins electricflow
- version/jenkins electricflow/1.1.6
- package-manager/maven