CVE-2019-1003014: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 13, 2022 (updated January 9, 2024)

An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.

References

access.redhat.com/errata/RHBA-2019:0326
access.redhat.com/errata/RHBA-2019:0327
github.com/advisories/GHSA-pmc5-74w3-78mw
github.com/jenkinsci/config-file-provider-plugin/commit/64fba993c897ff52a9c6c38c6c41806f2e8cc73f
jenkins.io/security/advisory/2019-01-28/
nvd.nist.gov/vuln/detail/CVE-2019-1003014

Code Behaviors & Features

Detect and mitigate CVE-2019-1003014 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →