Lucene search

JenkinsCVE-2019-10374

HistoryAug 07, 2019 - 3:15 p.m.

CVE-2019-10374

2019-08-0715:15:12

CWE-79

jenkins

web.nvd.nist.gov

cve-2019-10374

cross-site scripting

jenkins

pegdown formatter plugin

security vulnerability

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

22.0%

JSON

A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendered using the configured markup formatter to insert links with the javascript scheme into the Jenkins UI.

Affected configurations

Nvd

Node

jenkinspegdown_formatterRange≤1.3jenkins

VendorProductVersionCPE
jenkinspegdown_formatter*cpe:2.3:a:jenkins:pegdown_formatter:*:*:*:*:*:jenkins:*:*

Vendor	Product	Version	CPE
jenkins	pegdown_formatter	*	cpe:2.3:a:jenkins:pegdown_formatter::::::jenkins::*

CNA Affected

[
  {
    "product": "Jenkins PegDown Formatter Plugin",
    "vendor": "Jenkins project",
    "versions": [
      {
        "status": "affected",
        "version": "1.3 and earlier"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2019/08/07/1

jenkins.io/security/advisory/2019-08-07/#SECURITY-142

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

22.0%

JSON

Related for CVE-2019-10374