CVE-2019-1003042

A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.

Score

CVSS 3.0 5.4 Medium

Status

Modified - jenkinsci-cert@googlegroups.com

Published

2019-03-28

Last modified

2024-08-05

Weaknesses

CWE-79

Affected products

• Lockable Resources (Jenkins)
• Jenkins Lockable Resources Plugin (Jenkins Project)

References

• http://www.openwall.com/lists/oss-security/2019/03/28/2
• http://www.securityfocus.com/bid/107628
• https://access.redhat.com/errata/RHSA-2019:1423
• https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1361