CVE-2019-1003050

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.

Published: Apr 10, 2019
Updated: Oct 26, 2023
CVE: CVE-2019-1003050
GHSA: GHSA-qpg9-83fv-x9ch
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.4
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
jenkins / jenkins	-	2.164.1.x
jenkins / jenkins	-	2.171.x
oracle / communications_cloud_native_core_automated_test_suite	1.9.0	1.9.0.x
redhat / openshift_container_platform	3.11	3.11.x
org.jenkins-ci.main / jenkins-core	-	2.164.2
org.jenkins-ci.main / jenkins-core	2.165	2.172

http://www.securityfocus.com/bid/107889
https://access.redhat.com/errata/RHBA-2019:1605
https://github.com/jenkinsci/jenkins/commit/8eb632dda219ec8796420ce58d9564cddf8f8f93
https://github.com/jenkinsci/jenkins/commit/d393c7e9ba3ec44953ef1f8b11839421e2649ee7
https://jenkins.io/security/advisory/2019-04-10/#SECURITY-1327
https://www.oracle.com/security-alerts/cpuapr2022.html

Vulnerability Database

CVE-2019-1003050

Deep Security Visibility Without the Complexity