Description
Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 2 | jenkins | 1.565.3-1.el6op | RHBA-2014:1630 |
| Red Hat OpenShift 2 | jenkins-plugin-openshift | 0.6.40.1-0.el6op | RHBA-2014:1630 |
| Red Hat OpenShift 2 | openshift-origin-cartridge-jenkins | 1.20.3.5-1.el6op | RHBA-2014:1630 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | >= 1.533, < 1.551 | 1.551 | GHSA-vj6q-v2h7-6q5m |
| Maven | org.jenkins-ci.main:jenkins-core | < 1.532.2 | 1.532.2 | GHSA-vj6q-v2h7-6q5m |
Advisories 1
- RHBA-2014:1630 Red Hat Bug Fix Advisory: Red Hat OpenShift Enterprise 2.1 jenkins-plugin-openshift bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- jenkins-cve20142067-xss(91354) vdb-entry
- https://github.com/jenkinsci/jenkins/commit/5d57c855f3147bfc5e7fda9252317b428a700014
- [oss-security] 20140220 Re: Possible CVE Requests: several issues fixed in Jenkins (Advisory 2014-02-14) mailing-list
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14