Description
Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.402, < 2.414.1 | 2.414.1 | GHSA-69vw-3pcm-84rw |
| Maven | org.jenkins-ci.main:jenkins-core | < 2.401.3 | 2.401.3 | GHSA-69vw-3pcm-84rw |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.415, < 2.416 | 2.416 | GHSA-69vw-3pcm-84rw |
Advisories 1
- WID-SEC-2023-1902 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 26, 2023