Jenkins Template Workflows Plugin vulnerable to Stored Cross-site Scripting

MEDIO 5.4CVE-2023-35146 · GHSA-62v2-xwh3-5gvx · Published 14/06/2023 · updated 17/06/2026

En resumen

CVE-2023-35146 es una vulnerabilidad MEDIO (CVSS 5.4) que afecta a org.jenkins.plugin.templateWorkflows:template-workflows, template workflows (jenkins).
Probabilidad de explotación en los próximos 30 días (EPSS): 0.75%, mayor que el 55.1% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
org.jenkins.plugin.templateWorkflows:template-workflows Maven	`≤ 41.v32d86a`	No fix yet
template workflows jenkins	`≤ 41.v32d86a_313b_4a`	No fix yet

Description

Jenkins Template Workflows Plugin 41.v32d86a_313b_4a and earlier does not escape names of jobs used as buildings blocks for Template Workflow Job.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create jobs.

NVD description

Jenkins Template Workflows Plugin 41.v32d86a_313b_4a and earlier does not escape names of jobs used as buildings blocks for Template Workflow Job, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create jobs.

References

nvd.nist.gov/vuln/detail/CVE-2023-35146 · ADVISORY
jenkins.io/security/advisory/2023-06-14 · WEB
openwall.com/lists/oss-security/2023/06/14/5 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free