CVE-2019-10403

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability…

published September 25, 2019

CVSS
—
EPSS
1%
Percentile
63.5
In the wild
Unconfirmed
What it is

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01033 · 63.5th percentile
Published
2019-09-25T15:05Z
EPSS history
Timeline
  • 25 SEP 15:05Z
    Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability…
    cvelistv5