GHSA-52g6-pfrq-rxfv

Jenkins allows Cross-Site Scripting (XSS) in User Configuration

At a glance

Published: 2022-05-17 01:31 UTC
Updated: 2025-03-13 19:28 UTC
CVE: CVE-2013-5573
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Description

Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.

Affected packages

Package	Versions
Maven · org.jenkins-ci.main:jenkins-core	introduced 0, last affected 1.523

References

https://nvd.nist.gov/vuln/detail/CVE-2013-5573 ADVISORY
https://exchange.xforce.ibmcloud.com/vulnerabilities/89872 WEB
https://github.com/jenkinsci/jenkins PACKAGE
https://web.archive.org/web/20200229071540/http://www.securityfocus.com/bid/64414 WEB
http://packetstormsecurity.com/files/124513 WEB
http://seclists.org/bugtraq/2013/Dec/104 WEB
http://seclists.org/fulldisclosure/2013/Dec/159 WEB
http://www.exploit-db.com/exploits/30408 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database