VulnerabilityModified

CVE-2019-10349

A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.

MEDIUM 5.4EPSS 3.89%

Does this matter?

Lower severity and a low EPSS score (3.89%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 3.89% probability · 90th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: jenkins/dependency graph viewer
Source: jenkinsci-cert@googlegroups.com

References

http://packetstormsecurity.com/files/153610/Jenkins-Dependency-Graph-View-0.13-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2019/07/11/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/109156Broken Link, Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1177Vendor Advisory
http://packetstormsecurity.com/files/153610/Jenkins-Dependency-Graph-View-0.13-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2019/07/11/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/109156Broken Link, Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1177Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.