Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

Jenkins: Authenticated Users Can Inject Malicious Script

CVE-2013-2033 · published 12 years ago
Summary

A security issue in older versions of Jenkins allows authenticated users with permission to write to inject malicious code into the Jenkins website. This could allow an attacker to take control of a user's session or steal sensitive information. Update Jenkins to the latest version to fix this issue.

What to do
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 1.509.1.
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 1.514.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.main:jenkins-core < 1.509.1
>= 1.513, < 1.514
Fix: upgrade to 1.509.1
– jenkins jenkins < 1.509.1
< 1.514
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*
– cloudbees jenkins >= 1.466, < 1.466.14.1
>= 1.480, < 1.480.4.1
cpe:2.3:a:cloudbees:jenkins:*:*:*:*:enterprise:*:*:*
Original advisory text
Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote authenticated users with wr...
Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote authenticated users with write permission to inject arbitrary web script or HTML via unspecified vectors.
References
Severity
2.1 Low
Exploitation
2% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published10 Apr 2014
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-826f-32qm-vm3j · GHSA
CVE-2013-2033 · NVD
Track software like this
Free during beta