Jenkins build-metrics Plugin reflected cross-site scripting vulnerability

MEDIUM 6.1CVE-2019-10475 · GHSA-f8w9-66fp-3jgw · Published 23/10/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:build-metrics Maven	`≤ 1.3`	No fix yet
build-metrics jenkins	`≤ 1.3`	No fix yet

Description

Jenkins build-metrics Plugin does not properly escape the label query parameter, resulting in a reflected cross-site scripting vulnerability.

As of publication of this advisory, there is no fix.

NVD description

A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.

References

nvd.nist.gov/vuln/detail/CVE-2019-10475 · ADVISORY
jenkins.io/security/advisory/2019-10-23 · WEB
plugins.jenkins.io/build-metrics · WEB
packetstormsecurity.com/files/155200/Jenkins-Build-Metrics-1.3-Cross-Site-Scripting.html · WEB
openwall.com/lists/oss-security/2019/10/23/2 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free