CVE-2019-10403: Improper Neutralization of Input During Web Page Generation in Jenkins
Summary
CVE-2019-10403: Improper Neutralization of Input During Web Page Generation in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.176.4
>= 2.177, < 2.197
Fixed in 2.176.4 or 2.197, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It is widely used in the software development industry due to its extensive plugin ecosystem and flexibility. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for its fundamental functionality.
Vulnerability Detail
The vulnerability identified as CVE-2019-10403 is an instance of improper neutralization of input during web page generation in Jenkins. Specifically, versions 2.196 and earlier, as well as LTS 2.176.3 and earlier, fail to properly escape the SCM tag name on the tooltip for SCM tag actions. This oversight results in a stored cross-site scripting (XSS) vulnerability that can be exploited by users who have control over SCM tag names for these actions. The severity of this vulnerability is rated as moderate with a CVSS score of 5.4. The CWE ID associated with this vulnerability is CWE-79.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.176.42.176.4 -
>= 2.177, < 2.1972.197
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually sanitize the SCM tag names to prevent the execution of malicious scripts. This can be achieved by validating and escaping any user-controlled input before using it as an SCM tag name. Here is an example of how to sanitize the input using Java code:
import org.apache.commons.lang.StringEscapeUtils;
String sanitizedTagName = StringEscapeUtils.escapeHtml(userControlledTagName);
This code snippet utilizes the 'StringEscapeUtils' class from the Apache Commons Lang library to escape the user-controlled input and prevent XSS attacks.
Conclusion
In conclusion, the vulnerability identified as CVE-2019-10403 in the 'org.jenkins-ci.main:jenkins-core' package poses a moderate risk due to the potential for stored cross-site scripting attacks. It is crucial for Jenkins users to upgrade to the fixed versions of the package and ensure that all plugins and dependencies are also updated to their latest secure versions. By following the recommended steps, users can mitigate the risk and maintain the security of their Jenkins installations. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server that facilitates the building, testing, and deployment of software projects. It offers a wide range of plugins and integrations, making it a popular choice among developers.
'org.jenkins-ci.main:jenkins-core' is a core component of Jenkins that provides essential functionality for the automation server. It is responsible for handling various tasks such as job scheduling, user authentication, and plugin management.
A stored XSS vulnerability occurs when user-controlled input is not properly sanitized and is stored on a server. This allows an attacker to inject malicious scripts that are executed when other users access the affected page, potentially leading to unauthorized actions or data theft.
The severity of this vulnerability is rated as moderate with a CVSS score of 5.4. While it is not considered critical, it still poses a potential risk and should be addressed promptly to ensure the security of the Jenkins installation.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert is a platform that monitors and alerts in real-time for open-source vulnerabilities. Simply provide your 'pom.xml' file, and Vulert will analyze it to identify any vulnerable dependencies.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
