CVE-2019-10475: Jenkins build-metrics Plugin reflected cross-site scripting vulnerability
Summary
CVE-2019-10475: Jenkins build-metrics Plugin reflected cross-site scripting vulnerability. Affects org.jenkins-ci.plugins:build-metrics versions < 1.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins build-metrics Plugin is an open-source plugin for the Jenkins automation server. It provides metrics and visualizations for build data, allowing users to analyze and monitor their Jenkins builds. The plugin is written in Java and follows the Maven ecosystem. The vulnerability in question is a reflected cross-site scripting (XSS) vulnerability that affects the plugin.
Vulnerability Detail
The Jenkins build-metrics Plugin is vulnerable to a reflected cross-site scripting (XSS) attack. This vulnerability arises due to improper escaping of the label query parameter. An attacker can exploit this vulnerability by injecting malicious code into the label parameter, which will then be executed in the context of the user's browser. This can lead to various security risks, including the theft of sensitive information, session hijacking, and unauthorized actions on behalf of the user. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no specific workaround provided for this vulnerability. However, users can consider implementing general security best practices to minimize the risk of XSS attacks. This includes input validation and sanitization, ensuring proper encoding of user-generated content, and implementing Content Security Policies (CSP) to restrict the execution of untrusted scripts.
Conclusion
The Jenkins build-metrics Plugin is vulnerable to a reflected cross-site scripting (XSS) attack, which can have serious security implications. It is important to stay informed about any updates or patches addressing this vulnerability and apply them as soon as they become available. Regularly monitoring official sources for security advisories and following best practices for securing Jenkins installations can help mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.plugins:build-metrics →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of a user's browser, potentially leading to sensitive information theft, session hijacking, and unauthorized actions.
As of the publication of this advisory, there is no fix available. It is recommended to monitor official sources for updates and apply any patches or updates as soon as they become available.
No, the vulnerability affects versions 0 to 1.3 of the Jenkins build-metrics Plugin.
There is no known exploit at the time of this advisory. However, it is important to address this vulnerability promptly once a fix is available to mitigate the risk of potential exploitation.
In addition to updating the Jenkins build-metrics Plugin once a fix is available, it is recommended to follow general security best practices, such as regularly updating Jenkins and its plugins, implementing strong authentication mechanisms, and monitoring for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:build-metrics.
