https://bugzilla.redhat.com/show_bug.cgi?id=1699333
Bug ID: 1699333
Summary: CVE-2019-1003050 jenkins: Improper escaping of job
URLs in f:validateButton leads to cross-site scripting
vulnerability.
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Whiteboard: impact=moderate,public=20190410,reported=20190412,sour
ce=oss-security,cvss3=5.4/CVSS:3.0/AV:N/AC:L/PR:L/UI:R
/S:C/C:L/I:L/A:N,cwe=CWE-79,openshift-enterprise-3.4/j
enkins=new,openshift-enterprise-3.5/jenkins=new,opensh
ift-enterprise-3.6/jenkins=new,openshift-enterprise-3.
7/jenkins=new,openshift-enterprise-3.9/jenkins=new,ope
nshift-enterprise-3.10/jenkins=new,openshift-enterpris
e-3.11/jenkins=new,openshift-enterprise-4.1/jenkins=ne
w,fedora-all/jenkins=affected
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: mrehak(a)redhat.com
CC: adam.kaplan(a)redhat.com, ahardin(a)redhat.com,
aos-bugs(a)redhat.com, bleanhar(a)redhat.com,
ccoleman(a)redhat.com, dedgar(a)redhat.com,
eparis(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jgoulding(a)redhat.com, jokerman(a)redhat.com,
mchappel(a)redhat.com, mizdebsk(a)redhat.com,
mmccomas(a)redhat.com, msrb(a)redhat.com,
obulatov(a)redhat.com, wzheng(a)redhat.com
Target Milestone: ---
Classification: Other
The f:validateButton form control for the Jenkins UI did not properly escape
job URLs. This resulted in a cross-site scripting (XSS) vulnerability
exploitable by users with the ability to control job names.
External References:
https://jenkins.io/security/advisory/2019-04-10/
--
You are receiving this mail because:
You are on the CC list for the bug.