Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Jenkins UI job links can be used for malicious scripts

CVE-2019-1003050 · published 7 years ago
Summary

If a user controls a job name, they can inject malicious code into the Jenkins UI. This could lead to unintended actions or data theft. Update to the latest version of Jenkins to fix this issue.

What to do
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 2.164.2.
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 2.172.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.main:jenkins-core <= 2.164.1
>= 2.165, <= 2.171
Fix: upgrade to 2.164.2
– jenkins jenkins <= 2.164.1
<= 2.171
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
– oracle communications_cloud_native_core_automated_test_suite 1.9.0
cpe:2.3:a:oracle:communications_cloud_native_core_automated_test_suite:1.9.0:*:*:*:*:*:*:*
– redhat openshift_container_platform 3.11
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
Original advisory text
The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vul...
The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.4 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published10 Apr 2019
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-qpg9-83fv-x9ch · GHSA
CVE-2019-1003050 · NVD
Track software like this
Free during beta