{"id":"CVE-2019-10475","published":"2019-10-23T12:45:45Z","modified":"2024-08-04T22:24:18Z","title":"A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary…","vendor":"Jenkins project","product":"Jenkins build-metrics Plugin","tier":"core","eol":null,"affectedVersions":[{"vendor":"Jenkins project","product":"Jenkins build-metrics Plugin","versions":["1.3 and earlier"]}],"description":{"text":"A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.","provenance":"source","from":"CVE.org"},"summary":{"text":"A reflected cross-site scripting flaw in the Jenkins build-metrics Plugin, a component of the Jenkins project's plugin ecosystem, affects the web pages that this plugin serves. The available record does not specify the access, authentication, user interaction, or configuration required, so the exact preconditions for exploitation cannot be stated from it.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:21:05Z"},"cvss":null,"epss":{"score":0.57735,"percentile":0.99081,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1490","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2019/10/23/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://packetstormsecurity.com/files/155200/Jenkins-Build-Metrics-1.3-Cross-Site-Scripting.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:build-metrics","vulnerableRanges":["<=1.3"],"patched":[],"from":["GHSA-f8w9-66fp-3jgw"],"provenance":"source"}],"advisories":[{"id":"GHSA-f8w9-66fp-3jgw","url":"https://github.com/advisories/GHSA-f8w9-66fp-3jgw","severity":"MODERATE","ecosystem":"Maven","package":"org.jenkins-ci.plugins:build-metrics","vulnerableRanges":["<=1.3"],"patched":[],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-3730","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3730","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":47598,"url":"https://www.exploit-db.com/exploits/47598","title":"Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting","type":"webapps","platform":"java","date":"2019-11-08","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2019-11-08"},"pocGithub":{"count":1,"skipped":0,"earliest":"2019-11-06","earliestUrl":"https://github.com/vesche/CVE-2019-10475","repos":[{"name":"vesche/CVE-2019-10475","url":"https://github.com/vesche/CVE-2019-10475","stars":13,"created":"2019-11-06"}]},"nuclei":[{"id":"CVE-2019-10475","name":"Jenkins build-metrics 1.3 - Cross-Site Scripting","severity":"medium","path":"http/cves/2019/CVE-2019-10475.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10475.yaml"}],"first":{"date":"2019-11-06","source":"PoC-in-GitHub","url":"https://github.com/vesche/CVE-2019-10475"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/155200/Jenkins-Build-Metrics-1.3-Cross-Site-Scripting.html"],"flow":[],"timeline":[{"date":"2019-10-23","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-10475","provenance":"source"},{"date":"2019-11-06","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2019-11-08","url":"https://github.com/vesche/CVE-2019-10475","provenance":"source"}],"speed":{"daysToPublicExploit":14,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":24.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.82,"detail":"percentile 0.9908"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}