CVE-2019-10406: Improper Neutralization of Input During Web Page Generation in Jenkins
Summary
CVE-2019-10406: Improper Neutralization of Input During Web Page Generation in Jenkins. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 2.176.4
>= 2.177, < 2.197
Fixed in 2.176.4 or 2.197, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of features and plugins to support continuous integration and delivery. The vulnerable package in focus is 'org.jenkins-ci.main:jenkins-core'.
Vulnerability Detail
The vulnerability identified as CVE-2019-10406 affects Jenkins versions 2.196 and earlier, as well as LTS versions 2.176.3 and earlier. It stems from the lack of restrictions or filtering on values set as the Jenkins URL in the global configuration. This oversight leads to a stored cross-site scripting (XSS) vulnerability that can be exploited by attackers with Overall/Administer permission. This vulnerability is classified as CWE-79 and has a CVSSv3 score of 4.8.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.176.42.176.4 -
>= 2.177, < 2.1972.197
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually sanitize the Jenkins URL by ensuring it does not contain any malicious scripts or code. This can be done by carefully reviewing and validating the URL before saving it in the global configuration. However, this workaround is not recommended as it relies on manual intervention and may not provide complete protection against XSS attacks.
Conclusion
The CVE-2019-10406 vulnerability in Jenkins exposes a stored XSS risk due to improper neutralization of input during web page generation. Upgrading to the recommended versions and staying up to date with security patches is crucial to mitigate this vulnerability. It is also advisable to regularly check for vulnerabilities using tools like Vulert's playground. For further assistance or information on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
The vulnerability allows attackers with Overall/Administer permission to inject malicious scripts or code into Jenkins web pages. This can lead to various consequences, such as unauthorized access, data theft, or further exploitation of the compromised system.
No, this vulnerability requires attackers to have Overall/Administer permission in Jenkins. However, if an attacker gains such privileges, they can exploit the vulnerability remotely.
There have been no known instances of this vulnerability being exploited in the wild. However, it is essential to apply the recommended fixes and stay vigilant to prevent potential attacks.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Jenkins installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the pom.xml file without requiring access to the code or installation.
For more information about this vulnerability, you can refer to the CVE-2019-10406 entry or reach out to info@devnack.com for further support on vulnerability remediation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
