{"id":"CVE-2019-10396","aliases":["EUVD-2022-3833","GHSA-fv4q-4h24-23qr"],"status":"published","title":"Jenkins Dashboard View Plugin vulnerable to Cross-site Scripting","description":"Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able to change build descriptions.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00735,"percentile":0.54685,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2019-09-12T13:55:15Z","modified":"2026-10-24T10:30:45Z","fixes":[{"ecosystem":"Maven","package":"org.jenkins-ci.plugins:dashboard-view","fixed_in":["2.12"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jenkins-ci.plugins:dashboard-view","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.jenkins-ci.plugins:dashboard-view","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12"}]}],"versions":["2.0","2.0.1","2.0.2","2.1","2.10","2.11","2.2","2.3","2.4","2.5","2.6","2.7","2.8","2.9","2.9.1","2.9.10","2.9.11","2.9.12","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.9"]}],"products":[{"vendor":"jenkins","product":"dashboard_view"},{"vendor":"jenkins project","product":"jenkins dashboard view plugin"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2019/09/12/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1489","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10396","tags":["advisory"]},{"url":"https://github.com/jenkinsci/dashboard-view-plugin/commit/115238da2a8899358b32ee14e7076df23747d6c9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fv4q-4h24-23qr"}],"sources":{"cve":[{"id":"CVE-2019-10396","description":"Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able to change build descriptions.","status":"published","published":"2019-09-12T13:55:15Z","modified":"2024-08-04T22:17:20.506Z","updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2022-3833","description":"Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able to change build descriptions.","status":"published","published":"2019-09-12T13:55:15Z","modified":"2024-08-04T22:17:20Z","updated_at":"2026-11-03T02:40:53.055308Z"}],"ghsa":[{"id":"GHSA-fv4q-4h24-23qr","title":"Jenkins Dashboard View Plugin vulnerable to Cross-site Scripting","description":"Dashboard View Plugin did not escape the build description on the Latest Builds View. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the description of builds shown on that view.\n\nDashboard View Plugin now applies the configured markup formatter to the build description, rendering it as it appears elsewhere in Jenkins.","status":"published","published":"2022-05-24T16:55:59Z","modified":"2023-12-20T14:40:42Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:27.414424Z"}],"nvd":[{"id":"CVE-2019-10396","description":"Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able to change build descriptions.","status":"published","published":"2019-09-12T14:15:11.537Z","modified":"2026-06-17T02:10:51.497Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:28.126831Z"}],"osv":[{"id":"CVE-2019-10396","description":"Jenkins Dashboard View Plugin 2.11 and earlier did not escape build descriptions, resulting in a cross-site scripting vulnerability exploitable by users able to change build descriptions.","status":"published","published":"2019-09-12T14:15:11.537Z","modified":"2026-10-24T10:30:45.053616993Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:10.383287Z"},{"id":"GHSA-fv4q-4h24-23qr","title":"Jenkins Dashboard View Plugin vulnerable to Cross-site Scripting","description":"Dashboard View Plugin did not escape the build description on the Latest Builds View. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the description of builds shown on that view.\n\nDashboard View Plugin now applies the configured markup formatter to the build description, rendering it as it appears elsewhere in Jenkins.","status":"published","published":"2022-05-24T16:55:59Z","modified":"2024-02-16T08:17:00.960356Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:46.760785Z"}]}}