CVE-2019-10402: Improper Neutralization of Input During Web Page Generation in Jenkins
Summary
CVE-2019-10402: Improper Neutralization of Input During Web Page Generation in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.176.4
>= 2.177, < 2.197
Fixed in 2.176.4 or 2.197, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It is widely used in the software development industry due to its flexibility and extensive plugin ecosystem. The Jenkins Core package (org.jenkins-ci.main:jenkins-core) is a fundamental component of Jenkins, providing core functionalities and APIs for plugin development. Unfortunately, versions 2.196 and earlier, as well as LTS 2.176.3 and earlier, are susceptible to a stored cross-site scripting (XSS) vulnerability.
Vulnerability Detail
The vulnerability arises from the f:combobox form control in Jenkins Core. This control interprets item labels as HTML, allowing an attacker with permission to define its contents to inject malicious scripts. This stored XSS vulnerability can be exploited by crafting specially crafted input, which, when rendered on a web page, executes arbitrary code in the context of the victim's browser. This can lead to various security risks, including session hijacking, data theft, and unauthorized actions.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.176.42.176.4 -
>= 2.177, < 2.1972.197
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading immediately is not feasible, a temporary workaround is to restrict access to the f:combobox form control to trusted users only. This can be achieved by adjusting the permissions and user roles within the Jenkins instance. By limiting the ability to define the contents of the f:combobox control, the risk of exploitation can be mitigated.
Conclusion
In conclusion, Jenkins versions 2.196 and earlier, as well as LTS 2.176.3 and earlier, are vulnerable to a stored XSS vulnerability in the f:combobox form control. It is crucial to upgrade to the recommended versions or apply the provided workaround to mitigate the risk of exploitation. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the victim's browser, potentially leading to session hijacking, data theft, and unauthorized actions.
Users of Jenkins versions 2.196 and earlier, as well as LTS 2.176.3 and earlier, are affected by this vulnerability.
At the time of this report, there are no known public exploits targeting this vulnerability. However, it is essential to apply the necessary patches or workarounds to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely by an attacker with permission to define the contents of the f:combobox form control.
Yes, the CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
