Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade jenkins-ltsUpgrade jenkins | Mar 23, 2023 | Mar 9, 2023 |
| Jenkins 2023 03 08 | — | Upgrade Jenkins to the latest versionUpgrade Jenkins to version 2.394Upgrade Jenkins LTS to version 2.375.4Upgrade Jenkins LTS to the latest version | Mar 9, 2023 | Mar 8, 2023 |
| Redhat Openshift | — | Upgrade jenkins | May 10, 2023 | Mar 10, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub