UpHeron
All vulnerabilities

Servers and applications

CVE-2023-27898

Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have…

Severity
Critical 9.6
Published
10 Mar 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
2.375.4, 2.394
Sources
NVD

Affected software

SoftwareAffected versions
JenkinsServers and applications · cpe:a:jenkins:jenkins
  • From 2.270 before 2.394
  • From 2.277.1 before 2.375.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-27898
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-27898