CVE-2019-1003050: Jenkins

Medium severity, CVSS 5.4. EPSS: 1.3% chance of exploitation in the next 30 days.

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.

Affected products

• Jenkins Jenkins: up to and including 2.164.1; up to and including 2.171
• Oracle Communications Cloud Native Core Automated Test Suite: version 1.9.0 only
• Red Hat Openshift Container Platform: version 3.11 only

Published 2019-04-10. Last modified 2026-06-17.