CVE-2019-1003042

low-risk

Published 2019-03-28

A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.

Do I need to act?

0.09% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.4/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Lockable Resources

Affected Vendors

Jenkins

References (8)

Mailing List http://www.openwall.com/lists/oss-security/2019/03/28/2

Third Party Advisory http://www.securityfocus.com/bid/107628

https://access.redhat.com/errata/RHSA-2019:1423

Vendor Advisory https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1361

Mailing List http://www.openwall.com/lists/oss-security/2019/03/28/2

Third Party Advisory http://www.securityfocus.com/bid/107628

https://access.redhat.com/errata/RHSA-2019:1423

Vendor Advisory https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1361

/ 100

low-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal