CVE-2019-10349

EPSS 3.9%

A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.

Produtos afetados

Jenkins project · Jenkins Dependency Graph Viewer Plugin

PoCs públicas encontradas — 2

cve_referencepacketstormsecurity.com/files/153610/Jenkins-Dependency-Graph-View-0.13-Cross-Site-Scripting.htmlnão verificado exploitdbwww.exploit-db.com/exploits/47111não verificado

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

http://packetstormsecurity.com/files/153610/Jenkins-Dependency-Graph-View-0.13-Cross-Site-Scripting.html https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1177 http://www.openwall.com/lists/oss-security/2019/07/11/4 http://www.securityfocus.com/bid/109156