{"id":"CVE-2019-1003013","aliases":["EUVD-2022-2986","GHSA-7fjr-5hph-c2mh","RHBA-2019:0326"],"status":"published","title":"Cross-site Scripting in Jenkins Blue Ocean Plugin","description":"An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01227,"percentile":0.69228,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2019-02-06T16:00:00Z","modified":"2026-10-24T10:30:56Z","fixes":[{"ecosystem":"Maven","package":"io.jenkins.blueocean:blueocean","fixed_in":["1.10.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.jenkins.blueocean:blueocean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.jenkins.blueocean:blueocean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2"}]}],"versions":["1.0-alpha-1","1.0-alpha-2","1.0-alpha-3","1.0-alpha-4","1.0-alpha-5","1.0-alpha-6","1.0-alpha-7","1.0-alpha-8","1.0-alpha-9","1.0.0","1.0.0-b01","1.0.0-b02","1.0.0-b03","1.0.0-b04","1.0.0-b05","1.0.0-b06","1.0.0-b07","1.0.0-b08","1.0.0-b09","1.0.0-b10","1.0.0-b11","1.0.0-b12","1.0.0-b13","1.0.0-b14","1.0.0-b15","1.0.0-b16","1.0.0-b17","1.0.0-b18","1.0.0-b19","1.0.0-b19-beta-1","1.0.0-b20","1.0.0-b20-beta-1","1.0.0-b21","1.0.0-b21-beta-1","1.0.0-b22","1.0.0-b23","1.0.0-b24","1.0.0-b25","1.0.0-rc1","1.0.0-rc2","1.0.0-rc3","1.0.0-rc4","1.0.1","1.1.0","1.1.0-beta-1","1.1.0-beta-2","1.1.0-beta-4","1.1.0-beta-8","1.1.0-beta-9","1.1.1","1.1.2","1.1.4","1.1.5","1.1.6","1.1.7","1.10.1","1.2.0","1.2.0-beta-1","1.2.0-beta-3","1.2.0-beta-4","1.2.0-beta-5","1.2.0-beta-6","1.2.0-beta-7","1.2.1","1.2.2","1.2.3","1.2.4","1.3.0","1.3.0-beta-1","1.3.0-beta-2","1.3.0-beta-3","1.3.0-beta-4","1.3.0-beta-5","1.3.0-beta-6","1.3.1","1.3.2","1.3.3","1.3.4","1.3.5","1.3.6","1.4.0","1.4.0-beta-3","1.4.0-beta-4","1.4.0-beta-5","1.4.1","1.4.2","1.5.0","1.5.0-beta-1","1.5.0-beta-2","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.6.0","1.6.0-beta-1","1.6.0-beta-3","1.6.1","1.6.2","1.7.0","1.7.1","1.7.2","1.8.0","1.8.2","1.8.3","1.8.4","1.9.0","1.9.1"]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-enterprise-service-catalog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.11.82-1.git.1673.133961e.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-enterprise-service-catalog-svcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.11.82-1.git.1673.133961e.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-cluster-autoscaler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.efb6af0.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-descheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.300.89765c9.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-docker-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-dockerregistry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.452.0ce6383.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hypershift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-metrics-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.52.2fdca3f.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node-problem-detector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.254.a448936.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-service-idler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.14.e353758.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-template-service-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-web-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.355.5e8b1d9.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-openshift-oauth-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.425.7cac034.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.3bf41ce.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.1063.48444e8.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.5027.9d24833.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.17-3.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.17-3.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.17-3.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.150.2.1549032159-1.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.1549642489-1.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-playbooks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-roles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-enterprise-autoheal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.219.0b5aff4.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-enterprise-cluster-capacity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.380.cf11c51.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.5027.9d24833.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.3bf41ce.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"prometheus-node-exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.1063.48444e8.el7"}]}],"bundled":16}],"products":[{"vendor":"jenkins","product":"blue_ocean"},{"vendor":"jenkins project","product":"jenkins blue ocean plugins"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://access.redhat.com/errata/RHBA-2019:0326","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1204","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003013","tags":["advisory"]},{"url":"https://github.com/jenkinsci/blueocean-plugin/commit/62775e78532b756826bb237775b64a5052624b57","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7fjr-5hph-c2mh"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1506736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1598822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1615719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1623338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1634302","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1635254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1635613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1642379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1642929","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1651090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1651632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1655183","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1657019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659653","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659976","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1660598","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1664753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1665235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667618","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668412","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668828","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669555","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669984","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1673178","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_0326.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1658874","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20102","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20102","tags":["advisory"]},{"url":"https://www.mail-archive.com/haproxy@formilux.org/msg32055.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20103","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1658876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20103","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20103","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1663060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20615","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1647059","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000865","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000866","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000866","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3826","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1672865","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3826","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667566","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003000","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003000","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-08/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669505","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003001","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669508","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003002","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668345","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003003","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003003","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-16/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003004","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003004","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670292","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003010","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003010","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1095","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670296","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003011","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003011","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670298","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003012","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003012","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1201","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003013","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670299","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003013","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003014","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1671324","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003014","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1253","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2019-1003013","description":"An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.","status":"published","published":"2019-02-06T16:00:00Z","modified":"2024-08-05T03:00:19.473Z","updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2022-2986","description":"An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.","status":"published","published":"2019-02-06T16:00:00Z","modified":"2024-08-05T03:00:19Z","updated_at":"2026-11-03T02:40:19.824838Z"}],"ghsa":[{"id":"GHSA-7fjr-5hph-c2mh","title":"Cross-site Scripting in Jenkins Blue Ocean Plugin","description":"A cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.\nThis vulnerability is found in:\n- blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java \n- blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java\n- blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java\n- blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java\n- blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly \n","status":"published","published":"2022-05-13T01:31:35Z","modified":"2023-12-07T13:43:32Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:24.593982Z"}],"nvd":[{"id":"CVE-2019-1003013","description":"An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.","status":"published","published":"2019-02-06T16:29:00.703Z","modified":"2026-06-17T02:09:32.43Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:04.689371Z"}],"osv":[{"id":"CVE-2019-1003013","description":"An cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java, blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java, blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java, blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.","status":"published","published":"2019-02-06T16:29:00.703Z","modified":"2026-10-24T10:30:56.200962339Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"GHSA-7fjr-5hph-c2mh","title":"Cross-site Scripting in Jenkins Blue Ocean Plugin","description":"A cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.\nThis vulnerability is found in:\n- blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java \n- blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java\n- blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java\n- blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java\n- blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly \n","status":"published","published":"2022-05-13T01:31:35Z","modified":"2024-02-16T08:12:23.012224Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"RHBA-2019:0326","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update","status":"published","published":"2024-09-16T02:09:18Z","modified":"2026-08-05T10:05:51Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.117212Z"}]}}