vulnerability

Jenkins Advisory 2017-11-08: CVE-2017-1000392: Persisted XSS vulnerability in autocompletion suggestions

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:S/C:N/I:P/A:N)

Published

Nov 20, 2017

Added

Nov 20, 2017

Modified

Mar 27, 2026

Description

Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.

Solutions

jenkins-lts-upgrade-2_73_3jenkins-upgrade-2_89

References

CVE-2017-100039
https://attackerkb.com/topics/CVE-2017-100039
CWE-79
EUVD-EUVD-2022-2631
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2631
https://jenkins.io/security/advisory/2017-11-08/

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report