GitHub Advisoryadvisory · Maven

GHSA-69vw-3pcm-84rw Jenkins Stored Cross-site Scripting vulnerability

HIGH Published 2023-07-26 Modified 2023-08-21 Official page ↗
Aliases
CVE-2023-39151
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-79
Reviewed
2023-07-26

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: >= 2.402, < 2.414.1 → fixed in 2.414.1 • Maven org.jenkins-ci.main:jenkins-core: < 2.401.3 → fixed in 2.401.3 • Maven org.jenkins-ci.main:jenkins-core: >= 2.415, < 2.416 → fixed in 2.416

Description

Jenkins applies formatting to the console output of builds, transforming plain URLs into hyperlinks. Jenkins 2.415 and earlier, 2.414 and earlier, and LTS 2.401.2 and earlier does not sanitize or properly encode URLs of these hyperlinks in build logs. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents. Jenkins 2.416, 2.414.1, and LTS 2.401.3 encodes URLs of affected hyperlink annotations in build logs.

Related

Alias · CVE (1)

  • CVE-2023-39151 Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References