CVE-2019-10396
Jenkins Dashboard View Plugin vulnerable to Cross-site Scripting
5.4
MEDIUM
CVSS 3.1
EPSS 0.10%
Description
Dashboard View Plugin did not escape the build description on the Latest Builds View. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the description of builds shown on that view. Dashboard View Plugin now applies the configured markup formatter to the build description, rendering it as it appears elsewhere in Jenkins.
How to fix CVE-2019-10396
To remediate CVE-2019-10396, upgrade the affected package to a fixed version below.
- —upgrade to 2.12 or later
Is CVE-2019-10396 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 2.12
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |