Published: 10/03/2023 Updated: 24/05/2023

CVSS v3 Base Score: 9.6 | Impact Score: 6 | Exploitability Score: 2.8

VMScore: 0

Jenkins 2.270 up to and including 2.393 (both inclusive), LTS 2.277.1 up to and including 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.

Vulnerable Product	Search on Vulmon	Subscribe to Product
jenkins jenkins

Synopsis Moderate: OpenShift Container Platform 41056 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 41056 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Container Pla ...

Synopsis Critical: OpenShift Container Platform 41056 security update Type/Severity Security Advisory: Critical Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic Red Hat OpenShift Container Platform release 41056 is now available with updates to packages and ima ...

Synopsis Important: jenkins and jenkins-2-plugins security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for jenkins and jenkins-2-plugins is now available for OpenShift Developer Tools and Services for ...

Synopsis Critical: Multicluster Engine for Kubernetes 224 security fixes and container updates Type/Severity Security Advisory: Critical Topic Multicluster Engine for Kubernetes 224 General Availability release images, which fix security issues and update container imagesRed Hat Product Security has rated this update as having a security ...

DescriptionThe MITRE CVE dictionary describes this issue as: Jenkins 2270 through 2393 (both inclusive), LTS 22771 through 23753 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting ( ...

CWE-79 https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3037 https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2023:1656 https://access.redhat.com/security/cve/cve-2023-27898

CVE-2023-27898

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect