Cross-site Scripting in Jenkins Core

2022-05-1401:04:36

Google

osv.dev

0.001 Low

EPSS

Percentile

21.7%

JSON

A cross-site scripting vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in confirmationList.jelly and stopButton.jelly that allows attackers with Job/Configure and/or Job/Create permission to create an item name containing JavaScript that would be executed in another user’s browser when that other user performs some UI actions.

CPENameOperatorVersion
org.jenkins-ci.main:jenkins-coreeq2.60.3
org.jenkins-ci.main:jenkins-coreeq1.500
org.jenkins-ci.main:jenkins-coreeq1.571
org.jenkins-ci.main:jenkins-coreeq1.622
org.jenkins-ci.main:jenkins-coreeq2.75
org.jenkins-ci.main:jenkins-coreeq1.596.1
org.jenkins-ci.main:jenkins-coreeq1.510
org.jenkins-ci.main:jenkins-coreeq1.616
org.jenkins-ci.main:jenkins-coreeq1.566
org.jenkins-ci.main:jenkins-coreeq1.447

Name	Operator	Version
org.jenkins-ci.main:jenkins-core	eq	2.60.3
org.jenkins-ci.main:jenkins-core	eq	1.500
org.jenkins-ci.main:jenkins-core	eq	1.571
org.jenkins-ci.main:jenkins-core	eq	1.622
org.jenkins-ci.main:jenkins-core	eq	2.75
org.jenkins-ci.main:jenkins-core	eq	1.596.1
org.jenkins-ci.main:jenkins-core	eq	1.510
org.jenkins-ci.main:jenkins-core	eq	1.616
org.jenkins-ci.main:jenkins-core	eq	1.566
org.jenkins-ci.main:jenkins-core	eq	1.447