GHSA-7fjr-5hph-c2mhMediumCVSS 5.4

Cross-site Scripting in Jenkins Blue Ocean Plugin

Published
May 13, 2022
Last Modified
December 7, 2023

🔗 CVE IDs covered (1)

CVE-2019-1003013 →

📋 Description

A cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user. This vulnerability is found in:

  • blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java
  • blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java
  • blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java
  • blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java
  • blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly

🎯 Affected products1

  • maven/io.jenkins.blueocean:blueocean:< 1.10.2

🔗 References (6)