We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.
Reserved 2019-02-06 | Published 2019-02-06 | Updated 2024-08-05 | Assigner jenkinsaccess.redhat.com/errata/RHBA-2019:0326 (RHBA-2019:0326)
jenkins.io/security/advisory/2019-01-28/
access.redhat.com/errata/RHBA-2019:0327 (RHBA-2019:0327)
nvd.nist.gov (CVE-2019-1003013)
Support options
