CVE-2019-10349 Jenkins Dependency Graph Viewer Plugin contains Cross-site Scripting
Attackers with job configuration access can inject malicious scripts into Jenkins web pages via the Dependency Graph Viewer Plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-10349?
CVE-2019-10349 is a medium-severity cross-site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin, published on 11 Jul 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
Weakness: CWE-79
Which versions are affected by CVE-2019-10349?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:depgraph-view. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:depgraph-view Maven | All versions | 0.14 |
org.jenkins-ci.plugins:depgraph-view Maven | All versions | 0.14 |
Products include Jenkins Dependency Graph Viewer.
How do I fix CVE-2019-10349?
Upgrade org.jenkins-ci.plugins:depgraph-view to 0.14 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-10349 being exploited?
There is no known exploitation of CVE-2019-10349 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Jenkins Dependency Graph Viewer Plugin
Sources
Also known as GHSA-4wj7-rh5h-5qmr.