CVE-2019-10346: Cross-site Scripting in Jenkins Embeddable Build Status Plugin
Summary
CVE-2019-10346: Jenkins Embeddable Build Status Plugin contains Cross-site Scripting. Affects io.jenkins.plugins:embeddable-build-status-plugin versions < 2.0.2. Fixed in 2.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins Embeddable Build Status Plugin is a Maven package that provides functionality for displaying build status information in Jenkins. It allows users to embed build status badges in external websites or applications. This plugin is vulnerable to a reflected cross-site scripting (XSS) attack, which allows attackers to inject arbitrary HTML and JavaScript code into the plugin's response. This can lead to the execution of malicious scripts in the context of the user's browser.
Vulnerability Detail
The vulnerability in Jenkins Embeddable Build Status Plugin arises from insufficient input sanitization. When processing user-supplied data, the plugin fails to properly validate and sanitize the input, allowing attackers to inject malicious code. This can result in various security risks, including the theft of sensitive information, session hijacking, or the manipulation of user interfaces. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the Jenkins Embeddable Build Status Plugin until the fix can be applied. This can be done by navigating to the Jenkins plugin management page and disabling the plugin from the list of installed plugins.
Conclusion
The Jenkins Embeddable Build Status Plugin is vulnerable to a reflected cross-site scripting attack, which allows attackers to inject arbitrary code into the plugin's response. This can lead to various security risks, including the execution of malicious scripts in the user's browser. To fix the vulnerability, it is recommended to upgrade to version 2.0.2 or later of the plugin. Alternatively, the plugin can be temporarily disabled until the fix can be applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.jenkins.plugins:embeddable-build-status-plugin →
FAQ
The vulnerability allows attackers to inject arbitrary code into the plugin's response, potentially leading to the execution of malicious scripts in the user's browser. This can result in various security risks, including the theft of sensitive information or the manipulation of user interfaces.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file of your application.
While there is no specific known exploit for this vulnerability in the public domain, it is important to address it promptly to mitigate the risk of potential attacks.
There have been no reported incidents related to this vulnerability at the time of this report. However, it is advisable to take proactive measures to fix the vulnerability and prevent any potential exploitation.
Yes, a patch is available for this vulnerability in version 2.0.2 of the Jenkins Embeddable Build Status Plugin. It is recommended to upgrade to this version or later to mitigate the vulnerability.
