CVE-2019-10432: XSS
HTML Publisher Plugin did not escape the project or build display name shown in the frame HTML page. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the project or build display name, typically users with Job/Configure or Build/Update permission.
References:
https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1590
Other sources
Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting vulnerability exploitable by users able to change those.
Jenkins HTML Publisher Plugin prior to version 1.21 did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting vulnerability exploitable by users able to change those. This issue has been patched in version 1.21
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10432?
CVE-2019-10432 is a vulnerability in the Jenkins HTML Publisher Plugin 1.20 and earlier that allows for cross-site scripting attacks.
How severe is CVE-2019-10432?
CVE-2019-10432 has a severity rating of medium with a CVSS score of 5.4.
Which software versions are affected by CVE-2019-10432?
Jenkins HTML Publisher Plugin versions up to 1.20 are affected, while version 1.21 and later are not vulnerable.
How can I fix CVE-2019-10432?
To fix CVE-2019-10432, update Jenkins HTML Publisher Plugin to version 1.21 or later.
Where can I find more information about CVE-2019-10432?
You can find more information about CVE-2019-10432 on the official Jenkins website and the Red Hat Security Advisory.