~ / search / GHSA-7fjr-5hph-c2mh

GHSA-7fjr-5hph-c2mh

Cross-site Scripting in Jenkins Blue Ocean Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-1003013

Packages

EcosystemPackageAffectedFixed in
Maven io.jenkins.blueocean:blueocean < 1.10.2 1.10.2

Details

As written in the advisory (Markdown source, shown as plain text).

A cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user. This vulnerability is found in: - blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java - blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java - blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java - blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java - blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly

References

External links from the advisory. They lead to third-party sites.