Vulnerability in Jenkins Project Build-metrics Plugin
CVE-2019-10475
A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
EPSS: 0.924 (99.7th percentile) — read the EPSS interpretation.
Affected products
- Jenkins Project Build-metrics Plugin — versions 1.3 and earlier
Public proof-of-concept exploits
References
- jenkins.io/security/advisory/2019-10-23/ (x_refsource_CONFIRM)
- [oss-security] 20191023 Multiple vulnerabilities in Jenkins plugins (mailing-list, x_refsource_MLIST)
- packetstormsecurity.com/files/155200/Jenkins-Build-Metrics-1.3-Cross-Site-Scrip… (x_refsource_MISC)
Frequently asked questions
- What is CVE-2019-10475?
- CVE-2019-10475 is a vulnerability in Jenkins Project Build-metrics Plugin. Published 2019-10-23.
- Is CVE-2019-10475 known to be exploited?
- 19 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.