~ / search / GHSA-cqp7-hwm3-cfg7

GHSA-cqp7-hwm3-cfg7

XSS vulnerability in Jenkins Warnings Next Generation Plugin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-1003023

Packages

EcosystemPackageAffectedFixed in
Maven io.jenkins.plugins:warnings-ng < 2.0.0 2.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/model/DetailsTableModel.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourceDetail.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourcePrinter.java, src/main/java/io/jenkins/plugins/analysis/core/util/Sanitizer.java, src/main/java/io/jenkins/plugins/analysis/warnings/DuplicateCodeScanner.java that allows attackers with the ability to control warnings parser input to have Jenkins render arbitrary HTML.

References

External links from the advisory. They lead to third-party sites.