Vulnerability Description
A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Electricflow | <= 1.1.6 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2019/06/11/1Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/108747
- https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1420Vendor Advisory
- http://www.openwall.com/lists/oss-security/2019/06/11/1Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/108747
- https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1420Vendor Advisory
FAQ
What is CVE-2019-10336?
CVE-2019-10336 is a vulnerability with a CVSS score of 6.1 (MEDIUM). A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaSc...
How severe is CVE-2019-10336?
CVE-2019-10336 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-10336?
Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Electricflow.