{"id":"CVE-2019-1003014","published":"2019-02-06T16:00:00Z","modified":"2024-08-05T03:00:19Z","title":"An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in…","vendor":"Jenkins","product":"Jenkins Config File Provider Plugin","tier":"tail","description":{"text":"An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0088,"percentile":0.58977,"provenance":"source"},"cwes":[],"references":[{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1253","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0326","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":11.8,"factors":[{"name":"EPSS percentile","points":11.8}]},"vendorSlug":"jenkins","affectedVersions":[{"vendor":"Jenkins project","product":"Jenkins Config File Provider Plugin","versions":["3.4.1 and earlier"]}],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:config-file-provider","vulnerableRanges":["<3.5"],"patched":["3.5"],"from":["GHSA-pmc5-74w3-78mw"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4797","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-jenkins-config-file-provider-plugin-cve-2018-1000413","parents":[{"from":"CVE-2018-1000414","to":"CVE-2019-1003014","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.jenkins-ci.plugins:config-file-provider","fromFixed":"3.2","toFixed":"3.5","daysApart":28},{"kind":"same-code","provenance":"machine","files":["src/main/resources/lib/configfiles/configfiles.jelly","src/main/resources/lib/configfiles/providerlist.jelly"],"commits":["https://github.com/jenkinsci/config-file-provider-plugin/commit/5c1df554e44b712e5d926b8d5557c592bf9f0a33","https://github.com/jenkinsci/config-file-provider-plugin/commit/64fba993c897ff52a9c6c38c6c41806f2e8cc73f"],"basis":"rarely changed file"}]},{"from":"CVE-2018-1000413","to":"CVE-2019-1003014","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/main/resources/lib/configfiles/configfiles.jelly","src/main/resources/lib/configfiles/providerlist.jelly"],"commits":["https://github.com/jenkinsci/config-file-provider-plugin/commit/5c1df554e44b712e5d926b8d5557c592bf9f0a33","https://github.com/jenkinsci/config-file-provider-plugin/commit/64fba993c897ff52a9c6c38c6c41806f2e8cc73f"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.55,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2017-1000104","published":"2017-10-04","fixed":"2.16.2","kev":false},{"cve":"CVE-2018-1000413","published":"2019-01-09","fixed":"3.2","kev":false},{"cve":"CVE-2018-1000414","published":"2019-01-09","fixed":"3.2","kev":false},{"cve":"CVE-2019-1003014","published":"2019-02-06","fixed":"3.5","kev":false},{"cve":"CVE-2021-21642","published":"2021-04-21","fixed":"3.7.1","kev":false},{"cve":"CVE-2021-21643","published":"2021-04-21","fixed":"3.7.1","kev":false},{"cve":"CVE-2021-21644","published":"2021-04-21","fixed":"3.7.1","kev":false}],"package":"Maven:org.jenkins-ci.plugins:config-file-provider"}}