CVE-2019-1003050: Improper Neutralization of Input During Web Page Generation in Jenkins
Summary
CVE-2019-1003050: Improper Neutralization of Input During Web Page Generation in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.164.2
>= 2.165, < 2.172
Fixed in 2.164.2 or 2.172, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of features and plugins to support continuous integration and delivery. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for its basic functionality.
Vulnerability Detail
The f:validateButton form control in Jenkins UI had a vulnerability that allowed for cross-site scripting (XSS) attacks. This vulnerability affected Jenkins versions 2.171 and earlier, as well as Jenkins LTS 2.164.1 and earlier. The issue arose from the improper escaping of job URLs, which could be exploited by users with control over job names. An attacker could inject malicious scripts into the UI, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.164.22.164.2 -
>= 2.165, < 2.1722.172
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Jenkins is not immediately feasible, a temporary workaround is to sanitize user input and properly escape job URLs. This can be done by implementing input validation and output encoding techniques in the affected areas of the code. Here is an example of how to sanitize user input in Java using the OWASP Java Encoder library:
import org.owasp.encoder.Encode;
String userInput = request.getParameter("userInput");
String sanitizedInput = Encode.forHtml(userInput);
By sanitizing user input and encoding it properly, the risk of XSS attacks can be significantly reduced.
Conclusion
The vulnerability in Jenkins allows for cross-site scripting (XSS) attacks, potentially leading to unauthorized access and data theft. It is crucial to upgrade Jenkins to the recommended versions or apply the provided workaround to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server that facilitates continuous integration and delivery of software projects. It provides a wide range of features and plugins to support the development lifecycle.
The vulnerability allows for cross-site scripting (XSS) attacks, which can lead to unauthorized access, data theft, or other malicious activities. It is important to patch the vulnerability to prevent potential security breaches.
Jenkins versions 2.171 and earlier, as well as Jenkins LTS 2.164.1 and earlier, are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade Jenkins to version 2.164.2 or later if using versions 2.164.1 or earlier. For versions 2.165 to 2.171, upgrading to version 2.172 or later is advised.
If immediate upgrading is not feasible, a temporary workaround is to sanitize user input and properly escape job URLs. This can be done by implementing input validation and output encoding techniques in the affected areas of the code.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
