Skip to content
Fencer Vulns
medium 5.4

CVE-2019-1003050 json

Improper Neutralization of Input During Web Page Generation in Jenkins

published 2019-04-10 7 y ago modified 2026-06-17 4 mo ago also GHSA-qpg9-83fv-x9ch , EUVD-2022-5011

cvss
5.4
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 71%
public exploits
0
none known

Summary

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.

Patch / fix

  • maven org.jenkins-ci.main:jenkins-core 2.164.2, 2.172
  • cri-o openshift 3.11 1.11.14-1.rhaos3.11.gitd56660e.el7
  • jenkins openshift 3.11 2.164.2.1555422716-1.el7
  • prometheus openshift 3.11 3.11.117-1.git.1.f52d417.el7
  • jenkins-2-plugins openshift 3.11 3.11.1559667994-1.el7
  • openshift-ansible openshift 3.11 3.11.123-1.git.0.db681ba.el7
  • openshift-ansible-test openshift 3.11 3.11.123-1.git.0.db681ba.el7
  • openshift-ansible-roles openshift 3.11 3.11.123-1.git.0.db681ba.el7
  • prometheus-alertmanager openshift 3.11 3.11.117-1.git.1.207ef35.el7

red hat advisories RHBA-2019:1605

  • jenkins Alpine 3.9 2.164.2-r0

alpine advisories ALPINE-CVE-2019-1003050

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • jenkins Arch Linux 2.172-1

arch linux advisories AVG-948

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-1003050 updated cvss 5.4

jenkins: Improper escaping of job URLs in f:validateButton leads to cross-site scripting vulnerability.

  • Red Hat OpenShift Container Platform 3.4 jenkins Red Hat OpenShift Container Platform 3.5 jenkins
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.6 jenkins Red Hat OpenShift Container Platform 3.7 jenkins Red Hat OpenShift Container Platform 3.9 jenkins Red Hat OpenShift Container Platform 3.10 jenkins
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 3.11 jenkins 2.164.2.1555422716-1.el7, jenkins-2-plugins 3.11.1559667994-1.el7, prometheus 3.11.117-1.git.1.f52d417.el7, cri-o 1.11.14-1.rhaos3.11.gitd56660e.el7, openshift-ansible 3.11.123-1.git.0.db681ba.el7, openshift-ansible-test 3.11.123-1.git.0.db681ba.el7, +19 more
    fixed: vendor fix RHBA-2019:1605
  • Red Hat OpenShift Container Platform 4 jenkins
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.32% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 3.5 AV:N/AC:M/Au:S/C:N/I:P/A:N
GitHub 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven org.jenkins-ci.main:jenkins-core
<2.164.2
>=2.165, <2.172
2.164.2
2.172

Affected products

  • Jenkins project Jenkins

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.