Jenkins CVE-2019-1003050 Cross Site Scripting Vulnerability
BID:107889
CVE-2019-1003050 |Info
Jenkins CVE-2019-1003050 Cross Site Scripting Vulnerability
| Bugtraq ID: | 107889 |
| Class: | Input Validation Error |
| CVE: |
CVE-2019-1003050 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 10 2019 12:00AM |
| Updated: | Apr 10 2019 12:00AM |
| Credit: | Daniel Beck, CloudBees, Inc |
| Vulnerable: |
Jenkins Jenkins 2.164.1 Jenkins Jenkins 2.150.3 Jenkins Jenkins 2.150.2 Jenkins Jenkins 2.150.1 Jenkins Jenkins 2.138.4 Jenkins Jenkins 2.138.3 Jenkins Jenkins 2.138.2 Jenkins Jenkins 2.138.1 Jenkins Jenkins 2.121.3 Jenkins Jenkins 2.121.2 Jenkins Jenkins 2.121.1 Jenkins Jenkins 1.651.1 Jenkins Jenkins 1.625.3 Jenkins Jenkins 1.596.2 Jenkins Jenkins 1.466.1 Jenkins Jenkins 2.171 Jenkins Jenkins 2.170 Jenkins Jenkins 2.169 Jenkins Jenkins 2.168 Jenkins Jenkins 2.167 Jenkins Jenkins 2.166 Jenkins Jenkins 2.165 Jenkins Jenkins 2.164 Jenkins Jenkins 2.163 Jenkins Jenkins 2.162 Jenkins Jenkins 2.161 Jenkins Jenkins 2.160 Jenkins Jenkins 2.159 Jenkins Jenkins 2.158 Jenkins Jenkins 2.157 Jenkins Jenkins 2.156 Jenkins Jenkins 2.155 Jenkins Jenkins 2.154 Jenkins Jenkins 2.153 Jenkins Jenkins 2.146 Jenkins Jenkins 2.145 Jenkins Jenkins 2.144 Jenkins Jenkins 2.143 Jenkins Jenkins 2.142 Jenkins Jenkins 2.141 Jenkins Jenkins 2.140 Jenkins Jenkins 2.138 Jenkins Jenkins 2.137 Jenkins Jenkins 2.136 Jenkins Jenkins 2.135 Jenkins Jenkins 2.134 Jenkins Jenkins 2.133 Jenkins Jenkins 2.132 Jenkins Jenkins 2.131 |
| Not Vulnerable: |
Jenkins Jenkins 2.164.2 Jenkins Jenkins 2.172 |
Discussion
Jenkins CVE-2019-1003050 Cross Site Scripting Vulnerability
Jenkins is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
The following products are vulnerable:
Jenkins 2.171 and prior versions.
Jenkins LTS 2.164.1 and prior versions.
Jenkins is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
The following products are vulnerable:
Jenkins 2.171 and prior versions.
Jenkins LTS 2.164.1 and prior versions.
Exploit / POC
Jenkins CVE-2019-1003050 Cross Site Scripting Vulnerability
Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
Solution / Fix
Jenkins CVE-2019-1003050 Cross Site Scripting Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.