CVE-2019-10336

EPSS 1.4%

Vexday Risk Score

3Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS —EPSS 1.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

11 jun 2019Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in job configuration forms containing post-build steps provided by this plugin.

Produtos afetados

Jenkins project · Jenkins ElectricFlow Plugin

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1420 http://www.openwall.com/lists/oss-security/2019/06/11/1 http://www.securityfocus.com/bid/108747