Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-jenkins | Aug 22, 2024 | Jan 13, 2021 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jan 13, 2021 | |
| Jenkins 2021 01 13 | jenkins-lts-upgrade-2_263_2jenkins-upgrade-2_275 | Dec 2, 2021 | Jan 13, 2021 | |
| Redhat Openshift | linuxrpm-upgrade-conmonlinuxrpm-upgrade-jenkinslinuxrpm-upgrade-machine-config-daemonlinuxrpm-upgrade-openshiftlinuxrpm-upgrade-openshift-ansiblelinuxrpm-upgrade-openshift-clientslinuxrpm-upgrade-runc | Feb 19, 2021 | Jan 13, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub