Skip to content
OpenAdvisories
Medium · 4.8 CVE-2019-1003014 EUVD-2022-4797GHSA-pmc5-74w3-78mw

Jenkins Config File Provider Plugin XSS vulnerability

Published Feb 6, 2019 · Updated Aug 5, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Config File Provider Plugin Package: org.jenkins-ci.plugins:config-file-provider Category: Web / CMS Ecosystem: Maven

Description

An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Config File Provider Plugin 3.4.1 and earlier —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat OpenShift 3 atomic-enterprise-service-catalog +1 1:3.11.82-1.git.1673.133961e.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift +12 3.11.82-1.git.0.08bc31b.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-cluster-autoscaler 3.11.82-1.git.0.efb6af0.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-descheduler 3.11.82-1.git.300.89765c9.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-dockerregistry 3.11.82-1.git.452.0ce6383.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-metrics-server 3.11.82-1.git.52.2fdca3f.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-node-problem-detector 3.11.82-1.git.254.a448936.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-service-idler 3.11.82-1.git.14.e353758.el7 RHBA-2019:0326
Red Hat OpenShift 3 atomic-openshift-web-console 3.11.82-1.git.355.5e8b1d9.el7 RHBA-2019:0326
Red Hat OpenShift 3 golang-github-openshift-oauth-proxy 3.11.82-1.git.425.7cac034.el7 RHBA-2019:0326
Red Hat OpenShift 3 haproxy +1 1.8.17-3.el7 RHBA-2019:0326
Red Hat OpenShift 3 jenkins 2.150.2.1549032159-1.el7 RHBA-2019:0326
Red Hat OpenShift 3 jenkins-2-plugins 3.11.1549642489-1.el7 RHBA-2019:0326
Red Hat OpenShift 3 openshift-ansible +4 3.11.82-3.git.0.9718d0a.el7 RHBA-2019:0326
Red Hat OpenShift 3 openshift-enterprise-autoheal 3.11.82-1.git.219.0b5aff4.el7 RHBA-2019:0326
Red Hat OpenShift 3 openshift-enterprise-cluster-capacity 3.11.82-1.git.380.cf11c51.el7 RHBA-2019:0326
Red Hat OpenShift 3 prometheus +1 3.11.82-1.git.5027.9d24833.el7 RHBA-2019:0326
Red Hat OpenShift 3 prometheus-alertmanager +1 3.11.82-1.git.0.3bf41ce.el7 RHBA-2019:0326
Red Hat OpenShift 3 prometheus-node-exporter +1 3.11.82-1.git.1063.48444e8.el7 RHBA-2019:0326

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:config-file-provider < 3.5 3.5 GHSA-pmc5-74w3-78mw

Advisories 1

References