CVE-2019-10396

描述

Dashboard View Plugin did not escape the build description on the Latest Builds View. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the description of builds shown on that view. Dashboard View Plugin now applies the configured markup formatter to the build description, rendering it as it appears elsewhere in Jenkins.

如何修補 CVE-2019-10396

要修補 CVE-2019-10396,請將受影響套件升級到下列已修補版本。

• —升級至 2.12 或更新版本

CVE-2019-10396 正在被利用嗎?

低 — EPSS 為 0.7%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 2.12

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2019-10396
• WEBwww.openwall.com/lists/oss-security/2019/09/12/2
• WEBgithub.com/jenkinsci/dashboard-view-plugin/commit/115238da2a8899358b32ee14e7076df23747d6c9
• WEBjenkins.io/security/advisory/2019-09-12/#SECURITY-1489