1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-1204

[JENKINS:SECURITY-1204] XSS vulnerability via user description in Blue Ocean

Severity Medium
Affected Packages 2
Fixed Packages 2
CVEs 1
Info Packages References Vulnerabilities

Blue Ocean did not properly escape HTML/JavaScript content set on the current user's description field, resulting in a cross-site scripting vulnerability exploitable by administrators and other people accessing Jenkins with the same user account.

Blue Ocean now properly escapes HTML/JavaScript content set on the current user's description field.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/blueocean <= 1.10.1
pkg:github/jenkinsci/blueocean-plugin <= 1.10.1
Package Fixed Version
pkg:maven/org.jenkins-ci.plugins/blueocean = 1.10.2
pkg:github/jenkinsci/blueocean-plugin = 1.10.2
ID
JENKINS:SECURITY-1204
Severity
medium
Published
2019-01-28T00:00:00
(5 years ago)
Modified
2019-01-28T00:00:00
(5 years ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository blueocean repository https://github.com/jenkinsci/blueocean-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/blueocean org.jenkins-ci.plugins blueocean <= 1.10.1
Fixed pkg:maven/org.jenkins-ci.plugins/blueocean org.jenkins-ci.plugins blueocean = 1.10.2
Affected pkg:github/jenkinsci/blueocean-plugin jenkinsci blueocean-plugin <= 1.10.1
Fixed pkg:github/jenkinsci/blueocean-plugin jenkinsci blueocean-plugin = 1.10.2
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date