Jenkins Stored Cross-site Scripting vulnerability

中 5.4CVE-2023-39151 · BIT-jenkins-2023-39151 · GHSA-69vw-3pcm-84rw · 26/07/2023 公開 · 17/06/2026 更新

要点

CVE-2023-39151 は org.jenkins-ci.main:jenkins-core, jenkins (jenkins) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.00%（全脆弱性の 62.7% より高い）。
対処：2.414.1, 2.416, 2.401.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.jenkins-ci.main:jenkins-core Maven	`≥ 2.402, < 2.414.1≥ 2.415, < 2.416< 2.401.3`	`2.414.12.4162.401.3`
jenkins jenkins	`≤ 2.401.2≤ 2.415`	修正版なし

概要

Jenkins applies formatting to the console output of builds, transforming plain URLs into hyperlinks. Jenkins 2.415 and earlier, 2.414 and earlier, and LTS 2.401.2 and earlier does not sanitize or properly encode URLs of these hyperlinks in build logs. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents. Jenkins 2.416, 2.414.1, and LTS 2.401.3 encodes URLs of affected hyperlink annotations in build logs.

NVD の説明

Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.