CVE-2019-1003023: jenkins project jenkins warnings next generation plugin Cross-site Scripting

Vulnerability summary

CVE-2019-1003023 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in jenkins project jenkins warnings next generation plugin. EPSS estimates a 1.04% chance of exploitation in the next 30 days, higher than 63.5% of scored vulnerabilities.

Timeline

1. 06-02-2019
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/model/DetailsTableModel.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourceDetail.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourcePrinter.java, src/main/java/io/jenkins/plugins/analysis/core/util/Sanitizer.java, src/main/java/io/jenkins/plugins/analysis/warnings/DuplicateCodeScanner.java that allows attackers with the ability to control warnings parser input to have Jenkins render arbitrary HTML.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.