CVE-2019-10336 - A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin

Back Back to CVE browser

MEDIUM

A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin

Published Jun 11, 2019

6.1

MEDIUM

CVSS 3.0

EPSS 1.38%

Description

A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin.

Affected products

Vendor Jenkins project Product Jenkins ElectricFlow Plugin Default
n/a
- Version
  1.1.6 and earlier
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins ElectricFlow Plugin

n/a

Version	Status	Constraints
1.1.6 and earlier	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (8)

http://www.openwall.com/lists/oss-security/2019/06/11/1
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.securityfocus.com/bid/108747
vdb-entryx_refsource_BID
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5482
Advisory
https://github.com/advisories/GHSA-w3pj-v9jr-v2wc
Advisory
https://github.com/jenkinsci/electricflow-plugin/commit/4550f86e75e0927be644958ed088e4fa82c783b7
https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1420
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10336
https://web.archive.org/web/20200227033720/http://www.securityfocus.com/bid/108747

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/06/11/1		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.securityfocus.com/bid/108747		vdb-entryx_refsource_BID
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-5482		Advisory
https://github.com/advisories/GHSA-w3pj-v9jr-v2wc		Advisory
https://github.com/jenkinsci/electricflow-plugin/commit/4550f86e75e0927be644958ed088e4fa82c783b7
https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1420		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10336
https://web.archive.org/web/20200227033720/http://www.securityfocus.com/bid/108747