Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.6

Jenkins Fails to Properly Escape Plugin Version in Error Messages

CVE-2023-27898 · published 3 years ago
Summary

Jenkins version 2.270 and later may display a security error message that could be exploited by attackers to run malicious code on the system. This is a concern if your Jenkins instance allows users to upload plugins from untrusted sources. To mitigate the risk, consider upgrading to a fixed version of Jenkins or configuring your instance to only allow plugins from trusted sources.

What to do
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 2.394.
  • Update jenkins-ci org.jenkins-ci.main:jenkins-core to version 2.375.4.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.main:jenkins-core >= 2.376, < 2.394
< 2.375.4
Fix: upgrade to 2.394
– jenkins jenkins >= 2.270, < 2.394
>= 2.277.1, < 2.375.4
cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*
Original advisory text
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incom...
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
9.6 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published10 Mar 2023
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-j664-qhh4-hpf8 · GHSA
CVE-2023-27898 · NVD
Track software like this
Free during beta