CVE-2019-16562

CVE-2019-16562 is a stored cross-site scripting (XSS) vulnerability in the Jenkins buildgraph-view Plugin [1][3]. The plugin does not escape the description of builds when displaying them in its view, allowing users who can change build descriptions to inject malicious JavaScript [1][3].

To exploit this, an attacker must have the ability to change build descriptions, which typically requires at least Job/Configure permission [1]. The malicious script executes in the browsers of other users viewing the buildgraph view, requiring no additional user interaction [1].

Successful exploitation leads to stored XSS, enabling the attacker to perform actions on behalf of the victim, such as modifying jobs, viewing secrets, or escalating privileges [1]. The attack can affect all users who access the view.

As of the advisory published December 17, 2019, no fix was available for buildgraph-view Plugin [2]. Users are advised to restrict permissions to change build descriptions or remove the plugin if not needed [1][2].