Description

A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.

Remediation

References

CVE-2019-10383

Related Vulnerabilities

WordPress Plugin Webapp builder (Free mobile apps native iPhone iOS & Android Winphone mobile apps) Arbitrary File Upload (2.0)

WordPress Plugin Simply Poll Cross-Site Scripting and Cross-Site Request Forgery Vulnerabilities (1.4.1)

WordPress Plugin WPFront Scroll Top Cross-Site Scripting (2.0.5.07184)

Oracle Database Server CVE-2008-0339 Vulnerability (CVE-2008-0339)

WordPress Plugin Cool Video Gallery Command Injection (1.9)

Severity

Medium

Classification

CVE-2019-10383 CWE-707 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities