CVE-2019-10401: XSS
First published: Wed Sep 25 2019(Updated: )
In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents (typically Job/Configure).
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Jenkins | <=2.176.3 | |
| Jenkins Jenkins | <=2.196 | |
| maven/org.jenkins-ci.main:jenkins-core | >=2.177<=2.196 | 2.197 |
| maven/org.jenkins-ci.main:jenkins-core | <=2.176.3 | 2.176.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2019/09/25/3
- https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1498
- https://nvd.nist.gov/vuln/detail/CVE-2019-10401
- https://github.com/jenkinsci/jenkins/commit/df600eb7a28dea189c41037398fd36fcea36302e
- https://github.com/advisories/GHSA-hg6g-jj7g-x6v2 (Advisory)
Frequently Asked Questions
What is CVE-2019-10401?
CVE-2019-10401 is a vulnerability in Jenkins 2.196 and earlier LTS 2.176.3 and earlier that allows stored cross-site scripting (XSS) attacks.
How does the f:expandableTextBox form control interpret content in Jenkins?
The f:expandableTextBox form control in Jenkins 2.196 and earlier LTS 2.176.3 and earlier interprets its content as HTML when expanded.
Who can exploit the stored XSS vulnerability in Jenkins?
Users with permission to define the contents of the f:expandableTextBox form control, typically Job/Configure, can exploit the stored XSS vulnerability.
What is the severity level of CVE-2019-10401?
CVE-2019-10401 has a severity level of medium.
How can I mitigate CVE-2019-10401 in Jenkins?
To mitigate CVE-2019-10401, upgrade Jenkins to version 2.196 or later LTS 2.176.3 or later.
- collector/nvd-index
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-hg6g-jj7g-x6v2
- alias/CVE-2019-10401
- collector/nvd-cve
- collector/github-advisory
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- agent/trending
- vendor/jenkins
- canonical/jenkins jenkins
- version/jenkins jenkins/2.176.3
- version/jenkins jenkins/2.196
- package-manager/maven