CVE-2019-10335

CWE-79 — Cross-site Scripting (XSS)5 documents5 sources
Severity
5.4MEDIUM
EPSS
0.1%
top 82.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins ElectricflowJenkins Project Jenkins Electricflow Plugin
Timeline
PublishedJun 11
Latest updateMay 24

Description

A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jenkins or control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in the plugin-provided output on build status pages.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_electricflow_plugin1.1.5 and earlier

🔴Vulnerability Details

3
GHSA
Jenkins ElectricFlow Plugin is vulnerable to stored cross site scripting vulnerability↗2022-05-24
▶
OSV
Jenkins ElectricFlow Plugin is vulnerable to stored cross site scripting vulnerability↗2022-05-24
▶
CVEList
CVE-2019-10335: A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1↗2019-06-11
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2019-06-11↗2019-06-11
▶
CVE-2019-10335 (MEDIUM CVSS 5.4) | A stored cross site scripting vulne | cvebase.io