XSS in Jenkins Pegdown Formatter
CVE-2019-10374
A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendered using the configured markup formatter to insert links with the javascript scheme into the Jenkins UI.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.007 (50.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Jenkins Pegdown_formatter
- Jenkins Project Pegdown Formatter Plugin — versions 1.3 and earlier
Weakness classification (CWE)
References
- jenkinsci-cert@googlegroups.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
- jenkinsci-cert@googlegroups.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-10374?
- CVE-2019-10374 is a medium-severity vulnerability in Jenkins Pegdown Formatter, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2019-08-07.
- How severe is CVE-2019-10374?
- Medium severity. CVSS v3 base score is 5.4 out of 10.