CVE-2019-10374 json
Jenkins PegDown Formatter Plugin has Cross-site Scripting vulnerability
published 2019-08-07 7 y ago modified 2026-06-17 4 mo ago also GHSA-922h-x9qv-2274 , EUVD-2022-3263
- cvss
- 5.4
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 0
- none known
Summary
A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions and other fields rendered using the configured markup formatter to insert links with the javascript scheme into the Jenkins UI.
Exploit prediction
0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:pegdown-formatter | <=1.3 |
no fix listed |
Affected products
- Jenkins project Jenkins PegDown Formatter Plugin
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
jenkins.io
/security/advisory/2019-08-07/#SECURITY-142
web, vendor-advisory
-
openwall.com
/lists/oss-security/2019/08/07/1
mailing-list, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2019-10374
advisory
-
github.com
/jenkinsci/pegdown-formatter-plugin
package
Sources
- CVE List CVE-2019-10374
- GitHub Advisory GHSA-922h-x9qv-2274
- NVD CVE-2019-10374
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.