Description
A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | 2.191 and earlier, LTS 2.176.2 and earlier | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins | 2.176.3.1568229898-1.el7 | RHSA-2019:2789 |
| Red Hat OpenShift 3 | jenkins | 2.176.3.1569349414-1.el7 | RHSA-2019:3144 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.176.3 | 2.176.3 | GHSA-9m48-54pj-h248 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.177, < 2.192 | 2.192 | GHSA-9m48-54pj-h248 |
Advisories 2
- RHSA-2019:3144 Red Hat Security Advisory: OpenShift Container Platform 3.11 jenkins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2019:2789 Red Hat Security Advisory: OpenShift Container Platform 4.1.16 jenkins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025