Jenkins Stored Cross-site Scripting vulnerability

MEDIUM 5.4CVE-2023-39151 · BIT-jenkins-2023-39151 · GHSA-69vw-3pcm-84rw · Published 26/07/2023 · updated 17/06/2026

In short

CVE-2023-39151 is a MEDIUM (CVSS 5.4) vulnerability affecting org.jenkins-ci.main:jenkins-core, jenkins (jenkins).
Chance of exploitation in the next 30 days (EPSS): 1.00%, higher than 62.7% of all vulnerabilities.
Fix: update to 2.414.1, 2.416, 2.401.3 or later.

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-core Maven	`≥ 2.402, < 2.414.1≥ 2.415, < 2.416< 2.401.3`	`2.414.12.4162.401.3`
jenkins jenkins	`≤ 2.401.2≤ 2.415`	No fix yet

Description

Jenkins applies formatting to the console output of builds, transforming plain URLs into hyperlinks. Jenkins 2.415 and earlier, 2.414 and earlier, and LTS 2.401.2 and earlier does not sanitize or properly encode URLs of these hyperlinks in build logs. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents. Jenkins 2.416, 2.414.1, and LTS 2.401.3 encodes URLs of affected hyperlink annotations in build logs.

NVD description

Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.