CVE-2019-10396: XSS
Dashboard View Plugin did not escape the build description on the Latest Builds View. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the description of builds shown on that view.
Dashboard View Plugin now applies the configured markup formatter to the build description, rendering it as it appears elsewhere in Jenkins.
Other sources
Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able to change build descriptions.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10396?
CVE-2019-10396 is a vulnerability in the Jenkins Dashboard View Plugin 2.11 and earlier that allows cross-site scripting (XSS) attacks.
How does CVE-2019-10396 affect me?
If you are using Jenkins Dashboard View Plugin 2.11 or earlier, your system may be vulnerable to cross-site scripting attacks when users are able to change build descriptions.
How severe is CVE-2019-10396?
CVE-2019-10396 has a severity level of medium with a CVSS score of 5.4.
How can I fix CVE-2019-10396?
To fix CVE-2019-10396, you should upgrade your Jenkins Dashboard View Plugin to version 2.12 or later.
Are there any references for CVE-2019-10396?
Yes, you can find more information about CVE-2019-10396 at the following references: [Link 1](http://www.openwall.com/lists/oss-security/2019/09/12/2), [Link 2](https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1489).