CVE-2023-39151

Medium

Description

Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.

SeverityMedium

CVSS5.4

Exploit probability—

Product

Jenkins

PublishedJul 26, 2023

First seenJul 26, 2023

How to fix

Update

org.jenkins-ci.main:jenkins-core2.414.1, 2.401.3, 2.416 or later

Vendor advisories

jenkins.io/security/advisory/2023-07-26/#SECURITY-3188

Affected products

Product	Affected versions	Fixed in
jenkins jenkins	v ≤ 2.415, v ≤ 2.401.2	—
org.jenkins-ci.main:jenkins-coreMaven	2.402 ≤ v < 2.414.1, v < 2.401.3, 2.415 ≤ v < 2.416	2.414.1, 2.401.3, 2.416

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.