Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.0

Jenkins Authorize Project Plugin: Stored Cross-Site Scripting in Job Names

CVE-2024-52552 · published 1 year ago
Summary

If an attacker with permission to configure jobs enters malicious JavaScript code into a job name, it can be executed by other users, potentially allowing the attacker to steal sensitive information or take control of the system. This affects the Jenkins Authorize Project Plugin in versions 1.7.2 and earlier. Update the plugin to the latest version to fix this vulnerability.

What to do
  • Update jenkins-ci org.jenkins-ci.plugins:authorize-project to version 1.8.0.
Affected software
Ecosystem VendorProductAffected versions
maven jenkins-ci org.jenkins-ci.plugins:authorize-project < 1.8.0
Fix: upgrade to 1.8.0
– jenkins authorize_project <= 1.7.2
cpe:2.3:a:jenkins:authorize_project:*:*:*:*:*:jenkins:*:*
Original advisory text
Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting (XSS) vulnerabili...
Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.0 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published13 Nov 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-8886-8v27-85j8 · GHSA
CVE-2024-52552 · NVD
Track software like this
Free during beta