Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to control button labels.
CVSS Details
- CVSS 3.1 Base Score: 5.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade jenkins | Aug 22, 2024 | Jan 13, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jan 13, 2021 |
| Jenkins 2021 01 13 | — | Upgrade Jenkins to the latest versionUpgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 2.275Upgrade Jenkins LTS to version 2.263.2 | Dec 2, 2021 | Jan 13, 2021 |
| Redhat Openshift | — | Upgrade openshift-kuryrUpgrade python-oslo-configUpgrade ironic-images-ipa-ppc64leUpgrade python-oslo-dbUpgrade ironic-imagesUpgrade python-oslo-policyUpgrade butaneUpgrade python-oslo-i18nUpgrade kata-containersUpgrade openvswitch2.15Upgrade openshift-clientsUpgrade cri-toolsUpgrade python-toozUpgrade toolboxUpgrade ignitionUpgrade openshift-ansibleUpgrade python-ironic-prometheus-exporterUpgrade ironic-images-ipa-x86_64Upgrade haproxyUpgrade python-eventletUpgrade cri-oUpgrade python-oslo-utilsUpgrade python-oslo-concurrencyUpgrade redhat-release-coreosUpgrade machine-config-daemonUpgrade python-kubernetesUpgrade python-openstacksdkUpgrade coreos-installerUpgrade rteval-loadsUpgrade ostreeUpgrade python-oslo-logUpgrade python-keystoneauth1Upgrade conmonUpgrade atomic-openshift-service-idlerUpgrade python-oslo-serializationUpgrade python-debtcollectorUpgrade openstack-ironicUpgrade python-oslo-contextUpgrade openstack-ironic-python-agentUpgrade runcUpgrade openstack-ironic-inspectorUpgrade python-jsonschemaUpgrade ovn2.13Upgrade openshiftUpgrade python-openshiftUpgrade podmanUpgrade console-login-helper-messagesUpgrade python-sushy-oem-idracUpgrade rust-afterburnUpgrade python-ironic-lib | Feb 19, 2021 | Jan 13, 2021 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub