Lucene search

[email protected]CVE-2019-10349

HistoryJul 11, 2019 - 2:15 p.m.

CVE-2019-10349

2019-07-1114:15:10

CWE-79

[email protected]

web.nvd.nist.gov

cve-2019-10349

jenkins

dependency graph viewer plugin

xss

security

vulnerability

nvd

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.004 Low

EPSS

Percentile

74.0%

JSON

A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.

Affected configurations

NVD

Node

jenkinsdependency_graph_viewerRange≤0.13jenkins

CPENameOperatorVersion
jenkins:dependency_graph_viewerjenkins dependency graph viewerle0.13

CPE	Name	Operator	Version
jenkins:dependency_graph_viewer	jenkins dependency graph viewer	le	0.13

CNA Affected

[
  {
    "product": "Jenkins Dependency Graph Viewer Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "0.13 and earlier"
      }
    ]
  }
]