A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.
{
"versions": [
{
"introduced": "0"
},
{
"last_affected": "2.176.2"
},
{
"introduced": "0"
},
{
"last_affected": "2.191"
}
]
}[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.9.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.11"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.1"
}
]
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10383.json"