CVE-2019-10373

描述

Build Pipeline Plugin does not properly escape variables in views, resulting in a stored cross-site scripting vulnerability exploitable by users with permission to configure build pipelines. This vulnerability is only exploitable on Jenkins releases older than 2.146 or 2.138.2 due to the security hardening implemented in those releases. As of publication of this advisory, there is no fix.

如何修補 CVE-2019-10373

目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。

• —未列出修補版本

CVE-2019-10373 正在被利用嗎?

低 — EPSS 為 0.1%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, <= 1.5.8

CVSS 分數

參考連結(3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2019-10373
• WEBjenkins.io/security/advisory/2019-08-07/#SECURITY-879
• WEBwww.openwall.com/lists/oss-security/2019/08/07/1