GHSA-wrr5-p265-7252

Jenkins Warnings NG Plugin Cross-site scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-10325

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.jenkins.plugins:warnings-ng	< 5.1.0	5.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScript in build overview pages.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10325 advisory
https://github.com/jenkinsci/warnings-ng-plugin/blob/main/CHANGELOG.md#510---2019-5-31 web
https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1373 web
http://www.openwall.com/lists/oss-security/2019/05/31/2 web
http://www.securityfocus.com/bid/108540 web