Medium · 5.4 CVE-2019-10396 EUVD-2022-3833GHSA-fv4q-4h24-23qr

Jenkins Dashboard View Plugin vulnerable to Cross-site Scripting

Published Sep 12, 2019 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Dashboard View Plugin Package: org.jenkins-ci.plugins:dashboard-view Category: Web / CMS Ecosystem: Maven

Description

Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able to change build descriptions.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Dashboard View Plugin	2.11 and earlier	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:dashboard-view	< 2.12	2.12	GHSA-fv4q-4h24-23qr

References

[oss-security] 20190912 Multiple vulnerabilities in Jenkins plugins mailing-list
https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1489