Paper/Archive/CVE-2023-27898

CVE-2023-27898

Jenkins Project Jenkins — Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin d…

EPSS 2%CVSS 9.6

critical.is priorityof 100

CVSS 9.6 (NVD, ADP agree)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 79.0.790 × 2015.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.

Affected

ProductAffectedFixed inSource

Jenkins2.270 – < 2.*2.*CNA

Scores by source

CISA ADP9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

NVD9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisoryjenkins.io/security/advisory/2023-03-08/#SECURITY-3037