CVE-2019-10336

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins ElectricFlow Plugin	1.1.6 and earlier

References

http://www.openwall.com/lists/oss-security/2019/06/11/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/108747
https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1420Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/06/11/1Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/108747
https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1420Vendor Advisory

Timeline

Published: Jun 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-103377.5An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content o CVE-2019-103388.8A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient a CVE-2019-103398.8A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users wit CVE-2019-10347.8A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who CVE-2019-103408.8A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed u CVE-2019-103416.5A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overal CVE-2019-103424.3A missing permission check in Jenkins Docker Plugin 1.1.6 and earlier in various 'fillCredentialsIdItems' methods allowed users with Overall CVE-2019-103433.3Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the config CVE-2019-103444.3Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read CVE-2019-103455.5Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted fo CVE-2019-103466.1A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrar CVE-2019-103478.8Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the mas