CVE-2019-10346

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Embeddable Build Status Plugin	2.0.1 and earlier

References

http://www.openwall.com/lists/oss-security/2019/07/11/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/109156Broken Link, Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1419Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/07/11/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/109156Broken Link, Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1419Vendor Advisory

Timeline

Published: Jul 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-103478.8Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the mas CVE-2019-103488.8Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Exte CVE-2019-103495.4A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure j CVE-2019-10357.8A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who CVE-2019-103508.8Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users CVE-2019-103518.8Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users wit CVE-2019-103526.5A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.j CVE-2019-103537.5CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass C CVE-2019-103544.3A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fra CVE-2019-103558.8A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to CVE-2019-103568.8A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allo CVE-2019-103574.3A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to ob