{"id":"CVE-2019-10395","aliases":["EUVD-2022-3149","GHSA-88qj-3q6h-8m5q"],"status":"published","title":"Jenkins Build Environment Plugin vulnerable to Cross-site Scripting","description":"Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.145, 2.138.1, or older, exploitable by users able to change various job/build properties.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00688,"percentile":0.53051,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2019-09-12T13:55:15Z","modified":"2026-06-17T02:10:51Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:build-environment","fixed_in":["1.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:build-environment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:build-environment","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6"]}],"products":[{"vendor":"jenkins","product":"build_environment"},{"vendor":"jenkins project","product":"jenkins build environment plugin"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2019/09/12/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1476","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10395","tags":["advisory"]},{"url":"https://github.com/jenkinsci/build-environment-plugin/commit/c9797608e839d0dce1957e3c1b512b872839e603","tags":["web"]},{"url":"https://github.com/advisories/GHSA-88qj-3q6h-8m5q"}],"sources":{"cve":[{"id":"CVE-2019-10395","description":"Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.145, 2.138.1, or older, exploitable by users able to change various job/build properties.","status":"published","published":"2019-09-12T13:55:15Z","modified":"2024-08-04T22:17:20.568Z","updated_at":"2026-11-02T14:20:19.056416Z"}],"euvd":[{"id":"EUVD-2022-3149","description":"Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.145, 2.138.1, or older, exploitable by users able to change various job/build properties.","status":"published","published":"2019-09-12T13:55:15Z","modified":"2024-08-04T22:17:20Z","updated_at":"2026-11-03T02:40:53.055308Z"}],"ghsa":[{"id":"GHSA-88qj-3q6h-8m5q","title":"Jenkins Build Environment Plugin vulnerable to Cross-site Scripting","description":"Build Environment Plugin did not escape values of environment variables shown on its views. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the values of build environment variables, typically users with Job/Configure or Job/Build permission.\n\nJenkins applies the missing escaping by default since 2.146 and LTS 2.138.2, so newer Jenkins releases are not affected by this vulnerability.\n\nBuild Environment Plugin now escapes all variables displayed in its views.","status":"published","published":"2022-05-24T16:55:59Z","modified":"2023-12-06T14:09:34Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:24.593982Z"}],"nvd":[{"id":"CVE-2019-10395","description":"Jenkins Build Environment Plugin 1.6 and earlier did not escape variables shown on its views, resulting in a cross-site scripting vulnerability in Jenkins 2.145, 2.138.1, or older, exploitable by users able to change various job/build properties.","status":"published","published":"2019-09-12T14:15:11.473Z","modified":"2026-06-17T02:10:51.38Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:28.126831Z"}],"osv":[{"id":"GHSA-88qj-3q6h-8m5q","title":"Jenkins Build Environment Plugin vulnerable to Cross-site Scripting","description":"Build Environment Plugin did not escape values of environment variables shown on its views. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the values of build environment variables, typically users with Job/Configure or Job/Build permission.\n\nJenkins applies the missing escaping by default since 2.146 and LTS 2.138.2, so newer Jenkins releases are not affected by this vulnerability.\n\nBuild Environment Plugin now escapes all variables displayed in its views.","status":"published","published":"2022-05-24T16:55:59Z","modified":"2024-02-16T08:07:29.9062Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:42.077781Z"}]}}