The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade jenkins | Jun 21, 2019 | Apr 10, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 10, 2019 |
| Jenkins 2019 04 10 | — | Upgrade Jenkins LTS to version 2.164.2Upgrade Jenkins to version 2.172Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest version | Apr 12, 2019 | Apr 10, 2019 |
| Redhat Openshift | — | Upgrade openshift-enterprise-autohealUpgrade atomic-openshift-web-consoleUpgrade atomic-openshift-service-idlerUpgrade golang-github-openshift-oauth-proxyUpgrade atomic-openshift-node-problem-detectorUpgrade atomic-openshift-metrics-serverUpgrade openshift-ansibleUpgrade jenkins-2-pluginsUpgrade golang-github-prometheus-node_exporterUpgrade cri-oUpgrade golang-github-prometheus-alertmanagerUpgrade atomic-openshift-deschedulerUpgrade atomic-openshift-cluster-autoscalerUpgrade jenkinsUpgrade openshift-enterprise-cluster-capacityUpgrade atomic-openshift-dockerregistryUpgrade atomic-enterprise-service-catalogUpgrade golang-github-prometheus-prometheus | Jul 4, 2019 | Apr 10, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub