CVE-2019-10336: XSS
A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin.
Other sources
The configuration forms of various post-build steps contributed by CloudBees CD Plugin were vulnerable to cross-site scripting.
This allowed attackers able to control the output of connected ElectricFlow servers' APIs to inject arbitrary HTML and JavaScript into the configuration form.
CloudBees CD Plugin no longer interprets HTML/JavaScript in responses from ElectricFlow server APIs on job configuration forms.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10336 vulnerability?
CVE-2019-10336 is a reflected cross-site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier versions that allows attackers to inject arbitrary HTML and JavaScript into the configuration form.
Which software is affected by CVE-2019-10336 vulnerability?
Jenkins ElectricFlow Plugin versions up to and including 1.1.6 are affected by CVE-2019-10336 vulnerability.
What is the severity of CVE-2019-10336 vulnerability?
CVE-2019-10336 vulnerability has a severity value of 6.1, which is considered medium.
How can an attacker exploit CVE-2019-10336 vulnerability?
An attacker with control over the output of connected ElectricFlow servers' APIs can exploit CVE-2019-10336 vulnerability by injecting arbitrary HTML and JavaScript into the configuration form of affected software.
Is there a fix available for CVE-2019-10336 vulnerability?
Yes, a fix for CVE-2019-10336 vulnerability is available. Users should update to the latest version of Jenkins ElectricFlow Plugin (1.1.7 or later) to mitigate this vulnerability.