TI-2019-12426 Aliases CVE-2019-16564 GHSA-jf8x-943c-r4h6

Cross-site scripting in Jenkins Pipeline Aggregator View Plugin

LOW 26CWE-79Published 2019-12-17 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to affects view content such as job display name or pipeline stage names.

Why it matters now

EPSS 0.00688 52nd percentileScored 2026-11-07

Fix Fixed com.paul8620.jenkins.plugins:pipeline-aggregator-view (Maven): 1.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins Pipeline Aggregator View Plugin	up to 1.8	—	No fix listed	CNA
—	com.paul8620.jenkins.plugins:pipeline-aggregator-view (Maven)	before 1.9	1.9	Patch available	GHSA-jf8x-943c-r4h6

Jenkins Pipeline Aggregator View Plugin VendorJenkins Affected up to 1.8 Fixed in — No fix listed CNA
com.paul8620.jenkins.plugins:pipeline-aggregator-view (Maven) Vendor— Affected before 1.9 Fixed in 1.9 Patch available GHSA-jf8x-943c-r4h6

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:pipeline_aggregator_view::::::jenkins::*	up to 1.8	Vulnerable	Jenkins

cpe:2.3:a:jenkins:pipeline_aggregator_view:*:*:*:*:*:jenkins:*:* Versions up to 1.8 Vulnerable ·Jenkins

Remediation

Fix · GHSA-jf8x-943c-r4h6 com.paul8620.jenkins.plugins:pipeline-aggregator-view (Maven) Fixed in 1.9 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2019-16564
2026-10-03 Alias added: GHSA-jf8x-943c-r4h6

References

Advisory 3

Other 1

https://github.com/jenkinsci/pipeline-aggregator-view-plugin/commit/acb0eeeae60ec0ac2dc5c8b5639d77589aa95af3

TI-2023-13188 Cross-site scripting in Jenkins Pipeline Aggregator View Plugin CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences