Jenkins Build Environment Plugin vulnerable to Cross-site Scripting

中 5.4CVE-2019-10395 · GHSA-88qj-3q6h-8m5q · 12/09/2019 公開 · 17/06/2026 更新

要点

CVE-2019-10395 は org.jenkins-ci.plugins:build-environment, build environment (jenkins) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.69%（全脆弱性の 52.9% より高い）。
対処：1.7 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.plugins:build-environment Maven	`< 1.7`	`1.7`
build environment jenkins	`≤ 1.6`	修正版なし

概要

Build Environment Plugin did not escape values of environment variables shown on its views. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the values of build environment variables, typically users with Job/Configure or Job/Build permission.

Jenkins applies the missing escaping by default since 2.146 and LTS 2.138.2, so newer Jenkins releases are not affected by this vulnerability.

Build Environment Plugin now escapes all variables displayed in its views.

NVD の説明

Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.145, 2.138.1, or older, exploitable by users able to change various job/build properties.