CVE-2019-10336

MEDIUM

Jenkins ElectricFlow < 1.1.6 - Cross-Site Scripting via Post-Build Step Configuration

Title source: llm
STIX 2.1

Description

A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin.

References (3)

Core 3
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/06/11/1
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/108747

Scores

CVSS v3 6.1
EPSS 0.0138
EPSS Percentile 68.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
jenkins/electricflow < 1.1.6
org.jenkins-ci.plugins/electricflow 0 - 1.1.7Maven
Published Jun 11, 2019
Tracked Since Feb 18, 2026