CVE-2019-10406: XSS
Published Sep 25, 2019
·Updated
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.
Affected Software
2 affected components
Jenkins Jenkins<=2.176.3
Jenkins Jenkins<=2.196
Event History
Sep 25, 2019
CVE Published
via MITRE·03:05 PM
Data Sourced
via MITRE·03:05 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-10406?
CVE-2019-10406 is classified as a medium severity stored XSS vulnerability.
2
Who is affected by CVE-2019-10406?
CVE-2019-10406 affects Jenkins versions 2.196 and earlier, as well as LTS versions 2.176.3 and earlier.
3
How do I fix CVE-2019-10406?
To fix CVE-2019-10406, upgrade Jenkins to version 2.197 or later, or to LTS version 2.176.4 or later.
4
What type of attack does CVE-2019-10406 enable?
CVE-2019-10406 enables stored cross-site scripting (XSS) attacks that can be exploited by users with Overall/Administer permission.
5
What permissions are needed to exploit CVE-2019-10406?
An attacker would need Overall/Administer permissions to exploit CVE-2019-10406.