CVE-2023-27898
Fixed in a distro release EPSS 2%CVSS 9.6
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
Products: Jenkins project Jenkins
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | 2.394 |
| Maven | org.jenkins-ci.main:jenkins-core | 2.375.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | jenkins | 2.395-r0 |
| Chainguard | jenkins-compat | 2.395-r0 |
| Chainguard | jenkins-remoting | 2.395-r0 |
| Red Hat ocp tools 4.11 | jenkins | 0:2.401.1.1686831596-3.el8 |
| Red Hat ocp tools 4.11 | jenkins-2-plugins | 0:4.11.1686831822-1.el8 |
| Red Hat openshift 4.10 | haproxy | 0:2.2.19-4.el8 |
| Red Hat openshift 4.10 | haproxy-debugsource | 0:2.2.19-4.el8 |
| Red Hat openshift 4.10 | haproxy22 | 0:2.2.19-4.el8 |
| Red Hat openshift 4.10 | haproxy22-debuginfo | 0:2.2.19-4.el8 |
| Red Hat openshift 4.10 | jenkins | 0:2.387.1.1680701869-1.el8 |
| Red Hat openshift 4.10 | jenkins-2-plugins | 0:4.10.1680703106-1.el8 |
| Red Hat openshift 4.10 | openshift | 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift | 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-hyperkube | 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift-hyperkube | 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8 |
| Wolfi | jenkins | 2.395-r0 |
| Wolfi | jenkins-compat | 2.395-r0 |
| Wolfi | jenkins-remoting | 2.395-r0 |