CVE-2023-27898

2023-03-0817:14:48

jenkins

www.cve.org

cross-site scripting

jenkins

cve-2023-27898

security vulnerability

plugin compatibility

8.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.1%

JSON

Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Jenkins",
    "vendor": "Jenkins Project",
    "versions": [
      {
        "changes": [
          {
            "at": "2.375.4",
            "status": "unaffected"
          },
          {
            "at": "2.376",
            "status": "affected"
          },
          {
            "at": "2.387.1",
            "status": "unaffected"
          },
          {
            "at": "2.388",
            "status": "affected"
          },
          {
            "at": "2.394",
            "status": "unaffected"
          }
        ],
        "lessThan": "2.*",
        "status": "affected",
        "version": "2.270",
        "versionType": "maven"
      }
    ]
  }
]