CVE-2019-10336: XSS
First published: Tue Jun 11 2019(Updated: )
A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Electricflow | <=1.1.6 | |
| maven/org.jenkins-ci.plugins:electricflow | <=1.1.6 | 1.1.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2019/06/11/1
- http://www.securityfocus.com/bid/108747
- https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1420
- https://nvd.nist.gov/vuln/detail/CVE-2019-10336
- https://web.archive.org/web/20200227033720/http://www.securityfocus.com/bid/108747
- https://github.com/jenkinsci/electricflow-plugin/commit/4550f86e75e0927be644958ed088e4fa82c783b7
- https://github.com/advisories/GHSA-w3pj-v9jr-v2wc (Advisory)
Frequently Asked Questions
What is CVE-2019-10336 vulnerability?
CVE-2019-10336 is a reflected cross-site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier versions that allows attackers to inject arbitrary HTML and JavaScript into the configuration form.
Which software is affected by CVE-2019-10336 vulnerability?
Jenkins ElectricFlow Plugin versions up to and including 1.1.6 are affected by CVE-2019-10336 vulnerability.
What is the severity of CVE-2019-10336 vulnerability?
CVE-2019-10336 vulnerability has a severity value of 6.1, which is considered medium.
How can an attacker exploit CVE-2019-10336 vulnerability?
An attacker with control over the output of connected ElectricFlow servers' APIs can exploit CVE-2019-10336 vulnerability by injecting arbitrary HTML and JavaScript into the configuration form of affected software.
Is there a fix available for CVE-2019-10336 vulnerability?
Yes, a fix for CVE-2019-10336 vulnerability is available. Users should update to the latest version of Jenkins ElectricFlow Plugin (1.1.7 or later) to mitigate this vulnerability.
- collector/nvd-index
- collector/nvd-api
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-w3pj-v9jr-v2wc
- alias/CVE-2019-10336
- collector/github-advisory
- agent/severity
- agent/references
- agent/author
- agent/weakness
- agent/type
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- vendor/jenkins
- canonical/jenkins electricflow
- version/jenkins electricflow/1.1.6
- package-manager/maven