vulnerability

Red Hat OpenShift: CVE-2019-10406: jenkins: XSS vulnerability in Jenkins URL setting

Name: Red Hat OpenShift: CVE-2019-10406: jenkins: XSS vulnerability in Jenkins URL setting
Creator: Red Hat
Published: 2019-09-25T00:00:00.000Z
Keywords: CVE, CWE-79, Red Hat OpenShift, 2019, 10406, jenkins, linuxrpm-upgrade-jenkins, Severity 4

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:S/C:N/I:P/A:N)

Published

Sep 25, 2019

Added

Dec 29, 2020

Modified

Mar 30, 2026

Description

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.

Solution

linuxrpm-upgrade-jenkins

References

CVE-2019-10406
https://attackerkb.com/topics/CVE-2019-10406
CWE-79
EUVD-EUVD-2022-4224
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4224

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report