Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | alpine-linux-upgrade-jenkins | Sep 23, 2020 | Aug 12, 2020 |
| Freebsd | freebsd-upgrade-package-jenkinsfreebsd-upgrade-package-jenkins-lts | Aug 13, 2020 | Aug 12, 2020 | |
| Jenkins 2020 08 12 | jenkins-lts-upgrade-2_235_4jenkins-upgrade-2_252 | Dec 2, 2021 | Aug 12, 2020 | |
| Redhat Openshift | linuxrpm-upgrade-jenkins | Dec 29, 2020 | Aug 12, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub