En bref
- CVE-2019-1003013 est une vulnérabilité MOYENNE (CVSS 5.4) touchant io.jenkins.blueocean:blueocean, blue ocean (jenkins), openshift container platform (redhat).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.2%, plus élevée que 68.9% des vulnérabilités.
- Correctif : mettre à jour vers 1.10.2 ou plus récent.
Description
A cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.
This vulnerability is found in:
- blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java
- blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java
- blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java
- blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java
- blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly
NVD description
An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.
Autres vulnérabilités de io.jenkins.blueocean:blueocean
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free