Vulnerability Details CVE-2019-1003014
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 21.4%
CVSS Severity
CVSS v3 Score 4.8
CVSS v2 Score 3.5
References
- https://access.redhat.com/errata/RHBA-2019:0326
- https://access.redhat.com/errata/RHBA-2019:0327
- https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1253
- https://access.redhat.com/errata/RHBA-2019:0326
- https://access.redhat.com/errata/RHBA-2019:0327
- https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1253
Products affected by CVE-2019-1003014
-
cpe:2.3:a:jenkins:config_file_provider:1.0
-
cpe:2.3:a:jenkins:config_file_provider:1.1
-
cpe:2.3:a:jenkins:config_file_provider:1.2
-
cpe:2.3:a:jenkins:config_file_provider:1.4
-
cpe:2.3:a:jenkins:config_file_provider:1.5
-
cpe:2.3:a:jenkins:config_file_provider:1.6
-
cpe:2.3:a:jenkins:config_file_provider:1.6.1
-
cpe:2.3:a:jenkins:config_file_provider:1.9.1
-
cpe:2.3:a:jenkins:config_file_provider:2.0
-
cpe:2.3:a:jenkins:config_file_provider:2.1
-
cpe:2.3:a:jenkins:config_file_provider:2.1.1
-
cpe:2.3:a:jenkins:config_file_provider:2.10.0
-
cpe:2.3:a:jenkins:config_file_provider:2.10.1
-
cpe:2.3:a:jenkins:config_file_provider:2.11
-
cpe:2.3:a:jenkins:config_file_provider:2.12
-
cpe:2.3:a:jenkins:config_file_provider:2.13
-
cpe:2.3:a:jenkins:config_file_provider:2.14
-
cpe:2.3:a:jenkins:config_file_provider:2.14.1
-
cpe:2.3:a:jenkins:config_file_provider:2.14.2
-
cpe:2.3:a:jenkins:config_file_provider:2.15
-
cpe:2.3:a:jenkins:config_file_provider:2.15.1
-
cpe:2.3:a:jenkins:config_file_provider:2.15.2
-
cpe:2.3:a:jenkins:config_file_provider:2.15.3
-
cpe:2.3:a:jenkins:config_file_provider:2.15.4
-
cpe:2.3:a:jenkins:config_file_provider:2.15.5
-
cpe:2.3:a:jenkins:config_file_provider:2.15.6
-
cpe:2.3:a:jenkins:config_file_provider:2.15.7
-
cpe:2.3:a:jenkins:config_file_provider:2.16.0
-
cpe:2.3:a:jenkins:config_file_provider:2.16.1
-
cpe:2.3:a:jenkins:config_file_provider:2.16.2
-
cpe:2.3:a:jenkins:config_file_provider:2.16.3
-
cpe:2.3:a:jenkins:config_file_provider:2.16.4
-
cpe:2.3:a:jenkins:config_file_provider:2.17
-
cpe:2.3:a:jenkins:config_file_provider:2.18
-
cpe:2.3:a:jenkins:config_file_provider:2.2.1
-
cpe:2.3:a:jenkins:config_file_provider:2.3
-
cpe:2.3:a:jenkins:config_file_provider:2.4
-
cpe:2.3:a:jenkins:config_file_provider:2.5
-
cpe:2.3:a:jenkins:config_file_provider:2.5.1
-
cpe:2.3:a:jenkins:config_file_provider:2.6
-
cpe:2.3:a:jenkins:config_file_provider:2.6.1
-
cpe:2.3:a:jenkins:config_file_provider:2.6.2
-
cpe:2.3:a:jenkins:config_file_provider:2.7
-
cpe:2.3:a:jenkins:config_file_provider:2.7.1
-
cpe:2.3:a:jenkins:config_file_provider:2.7.2
-
cpe:2.3:a:jenkins:config_file_provider:2.7.3
-
cpe:2.3:a:jenkins:config_file_provider:2.7.4
-
cpe:2.3:a:jenkins:config_file_provider:2.7.5
-
cpe:2.3:a:jenkins:config_file_provider:2.8.1
-
cpe:2.3:a:jenkins:config_file_provider:2.9.1
-
cpe:2.3:a:jenkins:config_file_provider:2.9.2
-
cpe:2.3:a:jenkins:config_file_provider:2.9.3
-
cpe:2.3:a:jenkins:config_file_provider:3.0
-
cpe:2.3:a:jenkins:config_file_provider:3.1
-
cpe:2.3:a:jenkins:config_file_provider:3.2
-
cpe:2.3:a:jenkins:config_file_provider:3.3
-
cpe:2.3:a:jenkins:config_file_provider:3.4
-
cpe:2.3:a:jenkins:config_file_provider:3.4.1
-
cpe:2.3:a:redhat:openshift_container_platform:3.11