CVE-2019-10403
Improper Neutralization of Input During Web Page Generation in Jenkins
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.
- Record
CVE-2019-10403- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.
- Record
CVE-2019-10403- Updated
- 2026-11-02
EUVDEUVD-2022-2974 No score
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.
- Record
EUVD-2022-2974- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7cjc-xppr-xj6x
Improper Neutralization of Input During Web Page Generation in Jenkins
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.
- Record
GHSA-7cjc-xppr-xj6x- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.
- Record
CVE-2019-10403- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-7cjc-xppr-xj6x
Improper Neutralization of Input During Web Page Generation in Jenkins
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.
- Record
GHSA-7cjc-xppr-xj6x- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVRHBA-2020:0017
Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update
- Record
RHBA-2020:0017- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHBA-2020:0063
Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3 RPM release advisory
- Record
RHBA-2020:0063- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven |
through 2.176.3 | 2.176.4 |
org.jenkins-ci.main:jenkins-coreMaven |
2.177 to 2.196 | 2.197 |
org.jenkins-ci.main:jenkins-coreMaven |
before 2.176.4, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
2.176.4 |
org.jenkins-ci.main:jenkins-coreMaven |
2.177 up to 2.197, plus listed versions 2.1782.1792.1802.1812.182 Show 16 moreShow less2.1832.1842.1852.1862.1872.1892.1902.190.12.190.22.190.32.1912.1922.1932.1942.1952.196 |
2.197 |
jenkinsRed Hat:openshift:3.11::el7 From an advisory covering 6 CVEs |
before 0:2.176.4.1578402941-1.el7 | 0:2.176.4.1578402941-1.el7 |
jenkinsRed Hat:openshift:4.3::el7 From an advisory covering 7 CVEs |
before 0:2.204.1.1578490170-1.el7 | 0:2.204.1.1578490170-1.el7 |
openshiftRed Hat:openshift:4.3::el7 From an advisory covering 7 CVEs |
before 0:4.3.0-202001131753.git.0.0aee6a8.el7 | 0:4.3.0-202001131753.git.0.0aee6a8.el7 |
openshift-hyperkubeRed Hat:openshift:4.3::el7 From an advisory covering 7 CVEs |
before 0:4.3.0-202001131753.git.0.0aee6a8.el7 | 0:4.3.0-202001131753.git.0.0aee6a8.el7 |
openshiftRed Hat:openshift:4.3::el8 From an advisory covering 7 CVEs |
before 0:4.3.0-202001131753.git.0.0aee6a8.el8 | 0:4.3.0-202001131753.git.0.0aee6a8.el8 |
openshift-hyperkubeRed Hat:openshift:4.3::el8 From an advisory covering 7 CVEs |
before 0:4.3.0-202001131753.git.0.0aee6a8.el8 | 0:4.3.0-202001131753.git.0.0aee6a8.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10403 is a medium vulnerability (CVSS 5.4) in Jenkins, published September 25, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 64th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.176.4.
References
jenkins.io/security/advisory/2019-09-25
openwall.com/lists/oss-security/2019/09/25/3
nvd.nist.gov/vuln/detail/CVE-2019-10403
github.com/advisories/GHSA-7cjc-xppr-xj6x
access.redhat.com/errata/RHBA-2020:0017
bugzilla.redhat.com/show_bug.cgi?id=1652571
Show 42 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_0017.json
cve.org/CVERecord?id=CVE-2019-10401
groups.google.com/forum
Left out here: 498 versions. The JSON record has them.