GHSA-hc34-f55m-rh3m

Jenkins Wall Display Plugin Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-10376

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:jenkinswalldisplay	<= 0.6.34	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Wall Display Master Project Plugin does not properly escape the `customTheme` query parameter, resulting in a reflected cross-site scripting vulnerability. As of publication of this advisory, there is no fix.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10376 advisory
https://github.com/jenkinsci/walldisplay-plugin package
https://jenkins.io/security/advisory/2019-08-07/#SECURITY-751 web
http://www.openwall.com/lists/oss-security/2019/08/07/1 web