CVE-2019-10383

A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.

Published: Aug 28, 2019
Updated: May 9, 2024
CVE: CVE-2019-10383
GHSA: GHSA-9m48-54pj-h248
Severity: Low
Exploit:

CVSS v3:

Severity: Low
Score: 4.8
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v2:

Severity: Low
Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
jenkins / jenkins	-	2.176.2.x
jenkins / jenkins	-	2.191.x
oracle / communications_cloud_native_core_automated_test_suite	1.9.0	1.9.0.x
redhat / openshift_container_platform	3.11	3.11.x
redhat / openshift_container_platform	4.1	4.1.x
org.jenkins-ci.main / jenkins-core	-	2.176.3
org.jenkins-ci.main / jenkins-core	2.177	2.192

http://www.openwall.com/lists/oss-security/2019/08/28/4
https://access.redhat.com/errata/RHSA-2019:2789
https://access.redhat.com/errata/RHSA-2019:3144
https://jenkins.io/security/advisory/2019-08-28/#SECURITY-1453
https://www.oracle.com/security-alerts/cpuapr2022.html

Vulnerability Database

289,697

CVE-2019-10383