CVE-2019-16564 - Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to affects view content such as job display name or pipeline stage names

Back Back to CVE browser

MEDIUM

Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to affects view content such as job display name or pipeline stage names

Published Dec 17, 2019

5.4

MEDIUM

CVSS 3.1

EPSS 0.69%

Description

Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to affects view content such as job display name or pipeline stage names.

Affected products

Vendor Jenkins project Product Jenkins Pipeline Aggregator View Plugin Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=1.8

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Jenkins project

Jenkins Pipeline Aggregator View Plugin

n/a

Version	Status	Constraints
unspecified	affected	<=1.8

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

http://www.openwall.com/lists/oss-security/2019/12/17/1
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://github.com/advisories/GHSA-jf8x-943c-r4h6
Advisory
https://github.com/jenkinsci/pipeline-aggregator-view-plugin/commit/acb0eeeae60ec0ac2dc5c8b5639d77589aa95af3
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1593
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16564

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/12/17/1		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://github.com/advisories/GHSA-jf8x-943c-r4h6		Advisory
https://github.com/jenkinsci/pipeline-aggregator-view-plugin/commit/acb0eeeae60ec0ac2dc5c8b5639d77589aa95af3
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1593		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16564