CVE-2019-10335 Jenkins ElectricFlow Plugin is vulnerable to stored cross site scripting vulnerability

What is CVE-2019-10335?

CVE-2019-10335 is a medium-severity cross-site scripting vulnerability in Jenkins ElectricFlow Plugin, published on 11 Jun 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jenkins or control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in the plugin-provided output on build status pages.

Weakness: CWE-79

Which versions are affected by CVE-2019-10335?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:electricflow. It affects 1 product.

Products include Jenkins Electricflow.

How do I fix CVE-2019-10335?

Upgrade org.jenkins-ci.plugins:electricflow to 1.1.7 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-10335 being exploited?

There is no known exploitation of CVE-2019-10335 in the wild and no public exploit code.

Other vulnerabilities in Jenkins ElectricFlow Plugin

• CVE-2019-10334 Jenkins ElectricFlow Plugin globally and unconditionally disabled SSL/TLS certificate validation Medium 6.5
• CVE-2019-10336 Jenkins ElectricFlow Plugin is vulnerable to reflected cross site scripting vulnerability Medium 6.1
• CVE-2019-10331 Jenkins ElectricFlow Plugin cross-site request forgery vulnerability Medium 4.3
• CVE-2019-10332 Jenkins ElectricFlow Plugin missing permission check Medium 4.3
• CVE-2019-10333 Jenkins ElectricFlow Plugin Missing permission checks Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fx9p-2qvx-pgjv.