The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and
    earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability
    exploitable by users with the ability to control job names. (CVE-2019-1003050)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and
    newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier,
    because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI
    authentication caches. (CVE-2019-1003049)

  - The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and
    earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability
    exploitable by users with the ability to control job names. (CVE-2019-1003050)

The version of Jenkins running on the remote web server is prior to 2.172 or is a version of Jenkins LTS prior to 2.164.2. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass condition exists due to an incomplete fix for SECURITY-901, in which existing     remote-based CLI authentication caches. An unauthenticated, remote attacker can exploit this to bypass     existing Access Control Limitations and appear as an authenticated user. (CVE-2019-1003049)

  - A cross-site scripting (XSS) vulnerability exists due to improper validation of user-supplied input before     returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click     a specially crafted URL, to execute arbitrary script code in a user's browser session. (CVE-2019-1003050)     Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
418234	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-qpg9-83fv-x9ch)	Tenable Cloud Security	SCA Checks	medium
418234	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-qpg9-83fv-x9ch)	Tenable Self-Hosted Container Security	SCA Checks	medium
405036	Alpine: multiple jenkins packages: security update to 2.164.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405036	Alpine: multiple jenkins packages: security update to 2.164.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
124168	Jenkins < 2.164.2 LTS / 2.172 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2019-1003050

medium

Tenable Plugins

medium

medium

high

high

high