CVE-2019-1003014
Jenkins Config File Provider Plugin XSS vulnerability
4.8 MediumFix available
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
0.88%Unchanged since Apr 14, 2021
What each source reports
NVD Score used
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
- Record
CVE-2019-1003014- CVSS 3.0
- 4.8 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
- Record
CVE-2019-1003014- Updated
- 2026-11-02
EUVDEUVD-2022-4797 No score
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
- Record
EUVD-2022-4797- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pmc5-74w3-78mw
Jenkins Config File Provider Plugin XSS vulnerability
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
- Record
GHSA-pmc5-74w3-78mw- CVSS 3.0
- 4.8 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
- Record
CVE-2019-1003014- CVSS 3.0
- 4.8 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-pmc5-74w3-78mw
Jenkins Config File Provider Plugin XSS vulnerability
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
- Record
GHSA-pmc5-74w3-78mw- CVSS 3.0
- 4.8 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVRHBA-2019:0326
Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update
- Record
RHBA-2019:0326- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:config-file-providerMaven |
before 3.5 | 3.5 |
org.jenkins-ci.plugins:config-file-providerMaven |
before 3.5, plus listed versions 1.01.11.21.51.6.1 Show 45 moreShow less1.9.12.02.12.1.12.10.02.10.12.112.132.14-beta2.14.1-beta2.14.2-beta2.152.15.12.15.2-beta2.15.32.15.3-beta2.15.42.15.52.15.62.15.72.16.02.16.12.16.22.16.32.16.42.172.182.2.12.32.42.52.5.12.62.6.12.6.22.72.7.12.7.42.7.52.8.12.9.22.9.33.03.13.2 |
3.5 |
atomic-enterprise-service-catalogRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 1:3.11.82-1.git.1673.133961e.el7 | 1:3.11.82-1.git.1673.133961e.el7 |
atomic-enterprise-service-catalog-svcatRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 1:3.11.82-1.git.1673.133961e.el7 | 1:3.11.82-1.git.1673.133961e.el7 |
atomic-openshiftRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-clientsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-clients-redistributableRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-cluster-autoscalerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.efb6af0.el7 | 0:3.11.82-1.git.0.efb6af0.el7 |
atomic-openshift-deschedulerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.300.89765c9.el7 | 0:3.11.82-1.git.300.89765c9.el7 |
atomic-openshift-docker-excluderRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
Show 33 moreShow less
| Package | Affected | Fixed |
|---|---|---|
atomic-openshift-dockerregistryRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.452.0ce6383.el7 | 0:3.11.82-1.git.452.0ce6383.el7 |
atomic-openshift-excluderRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-hyperkubeRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-hypershiftRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-masterRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-metrics-serverRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.52.2fdca3f.el7 | 0:3.11.82-1.git.52.2fdca3f.el7 |
atomic-openshift-nodeRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-node-problem-detectorRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.254.a448936.el7 | 0:3.11.82-1.git.254.a448936.el7 |
atomic-openshift-podRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-sdn-ovsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-service-idlerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.14.e353758.el7 | 0:3.11.82-1.git.14.e353758.el7 |
atomic-openshift-template-service-brokerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-testsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.08bc31b.el7 | 0:3.11.82-1.git.0.08bc31b.el7 |
atomic-openshift-web-consoleRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.355.5e8b1d9.el7 | 0:3.11.82-1.git.355.5e8b1d9.el7 |
golang-github-openshift-oauth-proxyRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.425.7cac034.el7 | 0:3.11.82-1.git.425.7cac034.el7 |
golang-github-prometheus-alertmanagerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.3bf41ce.el7 | 0:3.11.82-1.git.0.3bf41ce.el7 |
golang-github-prometheus-node_exporterRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.1063.48444e8.el7 | 0:3.11.82-1.git.1063.48444e8.el7 |
golang-github-prometheus-prometheusRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.5027.9d24833.el7 | 0:3.11.82-1.git.5027.9d24833.el7 |
haproxyRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:1.8.17-3.el7 | 0:1.8.17-3.el7 |
haproxy-debuginfoRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:1.8.17-3.el7 | 0:1.8.17-3.el7 |
haproxy18Red Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:1.8.17-3.el7 | 0:1.8.17-3.el7 |
jenkinsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:2.150.2.1549032159-1.el7 | 0:2.150.2.1549032159-1.el7 |
jenkins-2-pluginsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.1549642489-1.el7 | 0:3.11.1549642489-1.el7 |
openshift-ansibleRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-3.git.0.9718d0a.el7 | 0:3.11.82-3.git.0.9718d0a.el7 |
openshift-ansible-docsRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-3.git.0.9718d0a.el7 | 0:3.11.82-3.git.0.9718d0a.el7 |
openshift-ansible-playbooksRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-3.git.0.9718d0a.el7 | 0:3.11.82-3.git.0.9718d0a.el7 |
openshift-ansible-rolesRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-3.git.0.9718d0a.el7 | 0:3.11.82-3.git.0.9718d0a.el7 |
openshift-ansible-testRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-3.git.0.9718d0a.el7 | 0:3.11.82-3.git.0.9718d0a.el7 |
openshift-enterprise-autohealRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.219.0b5aff4.el7 | 0:3.11.82-1.git.219.0b5aff4.el7 |
openshift-enterprise-cluster-capacityRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.380.cf11c51.el7 | 0:3.11.82-1.git.380.cf11c51.el7 |
prometheusRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.5027.9d24833.el7 | 0:3.11.82-1.git.5027.9d24833.el7 |
prometheus-alertmanagerRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.0.3bf41ce.el7 | 0:3.11.82-1.git.0.3bf41ce.el7 |
prometheus-node-exporterRed Hat:openshift:3.11::el7 From an advisory covering 16 CVEs |
before 0:3.11.82-1.git.1063.48444e8.el7 | 0:3.11.82-1.git.1063.48444e8.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-1003014 is a medium vulnerability (CVSS 4.8) in Jenkins Config File Provider, published February 6, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in org.jenkins-ci.plugins:config-file-provider 3.5.
References
jenkins.io/security/advisory/2019-01-28
access.redhat.com/errata/RHBA-2019:0326
nvd.nist.gov/vuln/detail/CVE-2019-1003014
github.com/jenkinsci/config-file-provider-plugin/commit/64fba993c897ff52a9c6c38c6c41806f2e8cc73f
Show 100 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1506736
security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_0326.json
cve.org/CVERecord?id=CVE-2018-20102
mail-archive.com/[email protected]/msg32055.html
This page doesn't list everything
Left out here: 3 versions. The JSON record has them.