{"id":"CVE-2019-1003014","aliases":["EUVD-2022-4797","GHSA-pmc5-74w3-78mw","RHBA-2019:0326"],"status":"published","title":"Jenkins Config File Provider Plugin XSS vulnerability","description":"An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.","severity":{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0088,"percentile":0.59537,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2019-02-06T16:00:00Z","modified":"2026-10-24T10:30:51Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:config-file-provider","fixed_in":["3.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:config-file-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:config-file-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5"}]}],"versions":["1.0","1.1","1.2","1.5","1.6.1","1.9.1","2.0","2.1","2.1.1","2.10.0","2.10.1","2.11","2.13","2.14-beta","2.14.1-beta","2.14.2-beta","2.15","2.15.1","2.15.2-beta","2.15.3","2.15.3-beta","2.15.4","2.15.5","2.15.6","2.15.7","2.16.0","2.16.1","2.16.2","2.16.3","2.16.4","2.17","2.18","2.2.1","2.3","2.4","2.5","2.5.1","2.6","2.6.1","2.6.2","2.7","2.7.1","2.7.4","2.7.5","2.8.1","2.9.2","2.9.3","3.0","3.1","3.2","3.3","3.4","3.4.1"]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-enterprise-service-catalog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.11.82-1.git.1673.133961e.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-enterprise-service-catalog-svcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.11.82-1.git.1673.133961e.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-cluster-autoscaler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.efb6af0.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-descheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.300.89765c9.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-docker-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-dockerregistry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.452.0ce6383.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hypershift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-metrics-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.52.2fdca3f.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node-problem-detector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.254.a448936.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-service-idler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.14.e353758.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-template-service-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.08bc31b.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-web-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.355.5e8b1d9.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-openshift-oauth-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.425.7cac034.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.3bf41ce.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.1063.48444e8.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.5027.9d24833.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.17-3.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.17-3.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"haproxy18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.17-3.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.150.2.1549032159-1.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.1549642489-1.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-playbooks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-roles","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-ansible-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-3.git.0.9718d0a.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-enterprise-autoheal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.219.0b5aff4.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-enterprise-cluster-capacity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.380.cf11c51.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.5027.9d24833.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.0.3bf41ce.el7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"prometheus-node-exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.82-1.git.1063.48444e8.el7"}]}],"bundled":16}],"products":[{"vendor":"jenkins","product":"config_file_provider"},{"vendor":"jenkins project","product":"jenkins config file provider plugin"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1253","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0326","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003014","tags":["advisory"]},{"url":"https://github.com/jenkinsci/config-file-provider-plugin/commit/64fba993c897ff52a9c6c38c6c41806f2e8cc73f","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pmc5-74w3-78mw"},{"url":"https://github.com/jenkinsci/config-file-provider-plugin","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1506736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1598822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1615719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1623338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1634302","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1635254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1635613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1642379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1642929","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1651090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1651632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1655183","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1657019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659653","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1659976","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1660598","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1664753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1665235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667618","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668412","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668828","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669194","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669555","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669984","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1673178","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_0326.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1658874","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20102","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20102","tags":["advisory"]},{"url":"https://www.mail-archive.com/haproxy@formilux.org/msg32055.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20103","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1658876","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20103","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20103","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1663060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20615","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1647059","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000865","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000866","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000866","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000866","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3826","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1672865","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3826","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667566","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003000","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003000","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-08/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003001","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669505","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003001","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1669508","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003002","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668345","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003003","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003003","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-16/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003004","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003004","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670292","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003010","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003010","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1095","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003011","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670296","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003011","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003011","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1102","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670298","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003012","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003012","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1201","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003013","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670299","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003013","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1003013","tags":["advisory"]},{"url":"https://jenkins.io/security/advisory/2019-01-28/#SECURITY-1204","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-1003014","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1671324","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1003014","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-1003014","description":"An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.","status":"published","published":"2019-02-06T16:00:00Z","modified":"2024-08-05T03:00:19.351Z","updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2022-4797","description":"An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.","status":"published","published":"2019-02-06T16:00:00Z","modified":"2024-08-05T03:00:19Z","updated_at":"2026-11-03T02:40:19.824838Z"}],"ghsa":[{"id":"GHSA-pmc5-74w3-78mw","title":"Jenkins Config File Provider Plugin XSS vulnerability","description":"An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.","status":"published","published":"2022-05-13T01:31:35Z","modified":"2024-01-09T18:37:19Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:30.183224Z"}],"nvd":[{"id":"CVE-2019-1003014","description":"An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.","status":"published","published":"2019-02-06T16:29:00.733Z","modified":"2026-06-17T02:09:32.56Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:04.689371Z"}],"osv":[{"id":"CVE-2019-1003014","description":"An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.","status":"published","published":"2019-02-06T16:29:00.733Z","modified":"2026-10-24T10:30:51.903017495Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"GHSA-pmc5-74w3-78mw","title":"Jenkins Config File Provider Plugin XSS vulnerability","description":"An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.","status":"published","published":"2022-05-13T01:31:35Z","modified":"2024-02-16T08:12:11.784703Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"RHBA-2019:0326","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix update","status":"published","published":"2024-09-16T02:09:18Z","modified":"2026-08-05T10:05:51Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.117212Z"}]}}