CVE-2019-10432: Jenkins HTML Publisher Plugin Cross-site Scripting Vulnerability
Summary
CVE-2019-10432: Jenkins HTML Publisher Plugin vulnerable to Cross-site Scripting. Affects org.jenkins-ci.plugins:htmlpublisher versions < 1.21. Fixed in 1.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins HTML Publisher Plugin is a Maven package that provides functionality for publishing HTML reports as part of Jenkins build processes. It allows users to display HTML reports within the Jenkins interface, enhancing the visibility of build results and project information.
Vulnerability Detail
The Jenkins HTML Publisher Plugin prior to version 1.21 is vulnerable to cross-site scripting (XSS) attacks. This vulnerability arises from the plugin's failure to properly escape the project and build display names in the HTML report frame. As a result, users with the ability to modify these names can inject malicious scripts into the HTML report, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Minimum fixed version
1.21
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the Jenkins HTML Publisher Plugin to the patched version.
Conclusion
The Jenkins HTML Publisher Plugin prior to version 1.21 is vulnerable to cross-site scripting attacks. To mitigate this risk, users should upgrade to the latest version of the plugin. It is important to promptly address and fix this vulnerability to prevent potential exploitation and protect the integrity of Jenkins build processes.
See every vulnerability recorded for org.jenkins-ci.plugins:htmlpublisher →
FAQ
This vulnerability allows attackers to execute arbitrary scripts within the context of the affected HTML report. Depending on the privileges of the user viewing the report, this can lead to various malicious activities such as session hijacking, data theft, or unauthorized access to sensitive information.
Users of Jenkins versions prior to 1.21 with the HTML Publisher Plugin installed are affected by this vulnerability. Administrators and developers who utilize this plugin should ensure they are using the latest patched version to mitigate the risk.
There are currently no known public exploits specifically targeting this vulnerability. However, given the nature of XSS vulnerabilities, it is important to address and fix this issue promptly to prevent potential exploitation.
Yes, the CVSS score for this vulnerability is 5.4, indicating a moderate severity level. It is crucial to apply the recommended fix to mitigate the risk associated with this vulnerability.
For more information about this vulnerability, you can refer to the GitHub Security Advisory database entry at [link to advisory]. Additionally, you can reach out to info@devnack.com for further support on vulnerability remediation.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:htmlpublisher.
