Jenkins Shortcut Job Plugin stored cross-site scripting vulnerability

MITTEL 5.4CVE-2023-40346 · GHSA-jg35-vf67-gg2j · Published 16/08/2023 · updated 17/06/2026

Kurz gesagt

CVE-2023-40346 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in io.jenkins.plugins:shortcut-job, shortcut job (jenkins).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.48%, höher als bei 41.5% aller Schwachstellen.
Abhilfe: auf 0.5 oder neuer aktualisieren.

Package	Affected versions	Patched versions
io.jenkins.plugins:shortcut-job Maven	`< 0.5`	`0.5`
shortcut job jenkins	`≤ 0.4`	No fix yet

Description

Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure shortcut jobs.

Shortcut Job Plugin 0.5 escapes the shortcut redirection URL.

NVD description

Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure shortcut jobs.

References

nvd.nist.gov/vuln/detail/CVE-2023-40346 · ADVISORY
jenkins.io/security/advisory/2023-08-16 · WEB
openwall.com/lists/oss-security/2023/08/16/3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free