Description
In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins | 2.340 – < unspecified, unspecified – ≤ 2.355 | unspecified |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | jenkins | 2.346.2-r0 | — |
| Alpine v3.23 | jenkins | 2.346.2-r0 | — |
| Alpine v3.22 | jenkins | 2.346.2-r0 | — |
| Alpine v3.21 | jenkins | 2.346.2-r0 | — |
| Alpine v3.20 | jenkins | 2.346.2-r0 | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | jenkins | 2.346.2-r0 | — |
| Alpine v3.18 | jenkins | 2.346.2-r0 | — |
| Alpine v3.17 | jenkins | 2.346.2-r0 | — |
| Alpine v3.16 | jenkins | 2.346.2-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.340, < 2.356 | 2.356 | GHSA-6g4r-q7qg-6qx6 |
Advisories 1
- WID-SEC-2022-0445 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 22, 2023