Description

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.

Remediation

References

CVE-2019-1003050

Related Vulnerabilities

WordPress Plugin Login with phone number Cross-Site Scripting (1.4.1)

Drupal Numeric Errors Vulnerability (CVE-2007-5416)

OpenSSL Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2022-2068)

PHP Improper Restriction of XML External Entity Reference Vulnerability (CVE-2013-1824)

WordPress Plugin Wrapper Link Elementor Malicious Code (1.0.3)

Severity

Medium

Classification

CVE-2019-1003050 CWE-707 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities