CVE-2019-10401

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents (typically Job/Configure).

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins	2.196 and earlier, LTS 2.176.3 and earlier

References

http://www.openwall.com/lists/oss-security/2019/09/25/3Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1498Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/09/25/3Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1498Vendor Advisory

Timeline

Published: Sep 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-104025.4In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a store CVE-2019-104035.4Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored CVE-2019-104045.4Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored CVE-2019-104055.4Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attac CVE-2019-104064.8Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulti CVE-2019-104076.5Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive v CVE-2019-104084.3A cross-site request forgery vulnerability in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers to trigger project gene CVE-2019-104094.3A missing permission check in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers with Overall/Read permission to trigger CVE-2019-10417.0An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfu CVE-2019-104105.4Jenkins Log Parser Plugin 2.0 and earlier did not escape an error message, resulting in a cross-site scripting vulnerability exploitable by CVE-2019-104117.5Jenkins Inedo BuildMaster Plugin 2.4.0 and earlier transmitted configured credentials in plain text as part of the global Jenkins configurat CVE-2019-104127.5Jenkins Inedo ProGet Plugin 1.2 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration for