Vulnerability Description
A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendered using the configured markup formatter to insert links with the javascript scheme into the Jenkins UI.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jenkins | Pegdown Formatter | <= 1.3 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2019/08/07/1Mailing ListThird Party Advisory
- https://jenkins.io/security/advisory/2019-08-07/#SECURITY-142Vendor Advisory
- http://www.openwall.com/lists/oss-security/2019/08/07/1Mailing ListThird Party Advisory
- https://jenkins.io/security/advisory/2019-08-07/#SECURITY-142Vendor Advisory
FAQ
What is CVE-2019-10374?
CVE-2019-10374 is a vulnerability with a CVSS score of 5.4 (MEDIUM). A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendered using the configured markup formatt...
How severe is CVE-2019-10374?
CVE-2019-10374 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-10374?
Check the references section above for vendor advisories and patch information. Affected products include: Jenkins Pegdown Formatter.