CVE-2019-10404

jenkins: Stored XSS vulnerability in queue item tooltip

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored XSS vulnerability exploitable by users able to control parts of the reason a queue item is blocked, such as label expressions not matching any idle executors.

CVSS 3.1 · 5.4 Medium EPSS 1.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2019-10403

jenkins: Stored XSS vulnerability in SCM tag action tooltip

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.

CVSS 3.1 · 5.4 Medium EPSS 1.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2019-10402

jenkins: XSS vulnerability in combobox form control

In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents.

CVSS 3.1 · 5.4 Medium EPSS 1.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2019-10401

jenkins: Stored XSS vulnerability in expandable textbox form control

In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents (typically Job/Configure).

CVSS 3.1 · 5.4 Medium EPSS 1.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2019-10400

jenkins-script-security-plugin: handling of subexpressions in increment and decrement expressions not involving actual assignment allowed attackers to execute arbitrary code in sandboxed scripts

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and decrement expressions not involving actual assignment allowed attackers to execute arbitrary code in sandboxed scripts.

CVSS 3.1 · 4.2 Medium EPSS 1.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Script Security Openshift

CVE-2019-10399

jenkins-script-security-plugin: handling of property names in property expressions in increment and decrement expressions allowed attackers to execute arbitrary code in sandboxed scripts

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions in increment and decrement expressions allowed attackers to execute arbitrary code in sandboxed scripts.

CVSS 3.1 · 4.2 Medium EPSS 1.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Script Security Openshift

CVE-2019-10394

jenkins-script-security-plugin: handling of property names in property expressions on the left-hand side of assignment expression leads to execute arbitrary code in sandboxed scripts

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions on the left-hand side of assignment expressions allowed attackers to execute arbitrary code in sandboxed scripts.

CVSS 3.1 · 4.2 Medium EPSS 1.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Script Security Openshift

CVE-2019-10393

jenkins-script-security-plugin: handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of method names in method call expressions allowed attackers to execute arbitrary code in sandboxed scripts.

CVSS 3.1 · 4.2 Medium EPSS 1.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Script Security Openshift

CVE-2019-10392

jenkins-git-client-plugin: OS command injection via 'git ls-remote'

Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.

CVSS 3.1 · 8.8 High EPSS 23.1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Git Client Openshift

CVE-2019-10384

jenkins: CSRF protection tokens for anonymous users did not expire in some circumstances (SECURITY-1491)

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Jenkins Oracle Redhat

Products

Jenkins Communications Cloud Native Core Automated Test Suite Openshift and 1 more

CVE-2019-10383

jenkins: stored cross-site scripting in update center web pages (SECURITY-1453)

A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.

CVSS 3.1 · 4.8 Medium EPSS 1.4% KEV · Not listed

Vendors

Jenkins Oracle Redhat

Products

Jenkins Communications Cloud Native Core Automated Test Suite Openshift and 1 more

CVE-2019-10357

jenkins-plugin-workflow-cps-global-lib: Missing permission check in Pipeline: Shared Groovy Libraries Plugin

A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Jenkins Redhat

Products

Pipeline\ Openshift Openshift Container Platform

CVE-2019-10356

jenkins-plugin-script-security: Sandbox bypass through method pointer expressions in Script Security Plugin

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code in sandboxed scripts.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Jenkins Redhat

Products

Script Security Openshift Openshift Container Platform

CVE-2019-10355

jenkins-plugin-script-security: Sandbox bypass through type casts in Script Security Plugin

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Jenkins Redhat

Products

Script Security Openshift Openshift Container Platform

CVE-2019-10354

jenkins: Unauthorized view fragment access (SECURITY-534)

A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.

CVSS 3.1 · 4.3 Medium EPSS 1.6% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift Openshift Container Platform

CVE-2019-10353

jenkins: CSRF protection tokens did not expire (SECURITY-626)

CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.

CVSS 3.0 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2019-10352

jenkins: Arbitrary file write vulnerability using file parameter definitions (SECURITY-1424)

A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.

CVSS 3.0 · 6.5 Medium EPSS 10.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift

CVE-2019-10337

jenkins-plugin-token-macro: XML External Entity processing the ${XML} macro

An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.

CVSS 3.0 · 7.5 High EPSS 2.0% KEV · Not listed

Vendors

Jenkins Redhat

Products

Token Macro Openshift

CVE-2019-10328

jenkins-plugin-workflow-remote-loader: Unsafe Script Security whitelist entry in Pipeline Remote Loader Plugin (SECURITY-921)

Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.

CVSS 3.0 · 9.9 Critical EPSS 1.9% KEV · Not listed

Vendors

Jenkins Redhat

Products

Pipeline Remote Loader Openshift

CVE-2019-10320

jenkins-credentials-plugin: Certificate file read vulnerability in Credentials Plugin (SECURITY-1322)

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.

CVSS 3.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Credentials Openshift