CVE-2019-16562

2019-12-1715:15:19

Google

osv.dev

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.2%

JSON

Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored XSS vulnerability exploitable by users able to change build descriptions.

CPENameOperatorVersion
buildgraph-view-plugineqbuildgraph-view-1.1
buildgraph-view-plugineqbuildgraph-view-1.1.1
buildgraph-view-plugineqbuildgraph-view-1.5.1
buildgraph-view-plugineqbuildgraph-view-1.5.2
buildgraph-view-plugineqbuildgraph-view-1.4
buildgraph-view-plugineqbuildgraph-view-1.7
buildgraph-view-plugineqbuildgraph-view-1.3.1
buildgraph-view-plugineqbuildgraph-view-1.3.2
buildgraph-view-plugineqbuildgraph-view-1.2
buildgraph-view-plugineqbuildgraph-view-1.5

Name	Operator	Version
buildgraph-view-plugin	eq	buildgraph-view-1.1
buildgraph-view-plugin	eq	buildgraph-view-1.1.1
buildgraph-view-plugin	eq	buildgraph-view-1.5.1
buildgraph-view-plugin	eq	buildgraph-view-1.5.2
buildgraph-view-plugin	eq	buildgraph-view-1.4
buildgraph-view-plugin	eq	buildgraph-view-1.7
buildgraph-view-plugin	eq	buildgraph-view-1.3.1
buildgraph-view-plugin	eq	buildgraph-view-1.3.2
buildgraph-view-plugin	eq	buildgraph-view-1.2
buildgraph-view-plugin	eq	buildgraph-view-1.5