First published: Wed Aug 28 2019(Updated: )
A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
Affected Software | Affected Version | How to fix |
---|---|---|
maven/org.jenkins-ci.main:jenkins-core | >=2.177<=2.191 | 2.192 |
maven/org.jenkins-ci.main:jenkins-core | <=2.176.2 | 2.176.3 |
Jenkins Jenkins | <=2.176.2 | |
Jenkins Jenkins | <=2.191 | |
Oracle Communications Cloud Native Core Automated Test Suite | =1.9.0 | |
Redhat Openshift Container Platform | =3.11 | |
Redhat Openshift Container Platform | =4.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of CVE-2019-10383 is medium with a CVSS score of 4.8.
CVE-2019-10383 affects Jenkins versions 2.191 and earlier LTS 2.176.2 and earlier, allowing attackers with Overall/Administer permission to inject arbitrary HTML and JavaScript in update center web pages.
An attacker with Overall/Administer permission in Jenkins can exploit CVE-2019-10383 by configuring the update site URL to inject arbitrary HTML and JavaScript.
The affected software for CVE-2019-10383 includes Jenkins versions 2.191 and earlier LTS 2.176.2 and earlier.
To fix CVE-2019-10383, it is recommended to update Jenkins to version 2.192 or LTS 2.176.3 or later.