Cross-site Scripting vulnerability in Jenkins
High severity
GitHub Reviewed
Published
Mar 10, 2023
to the GitHub Advisory Database
•
Updated Jan 5, 2024
Package
Affected versions
>= 2.376, < 2.394
< 2.375.4
Patched versions
2.394
2.375.4
Description
Published by the National Vulnerability Database
Mar 10, 2023
Published to the GitHub Advisory Database
Mar 10, 2023
Reviewed
Mar 17, 2023
Last updated
Jan 5, 2024
Credits
-
westonsteimel Analyst
-
yakirk Analyst
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
References