Jenkins allows Cross-Site Scripting (XSS) via Crafted URL

中危 6.1CVE-2012-4439 · GHSA-x97g-3gp9-cf2p · Published 18/11/2019 · updated 16/06/2026

要点

CVE-2012-4439 是影响 org.jenkins-ci.main:jenkins-core, jenkins (jenkins) 的中危 (CVSS 6.1)漏洞。
未来 30 天内被利用的概率（EPSS）：1.8%，高于 79.1% 的漏洞。
修复：升级到 1.482, 1.466.2 或更高版本。

Package	Affected versions	Patched versions
org.jenkins-ci.main:jenkins-core Maven	`≥ 1.467, < 1.482< 1.466.2`	`1.4821.466.2`
jenkins jenkins	`< 1.466.2< 1.482`	`1.466.21.482`

Description

Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins.

NVD description

Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins.

References

nvd.nist.gov/vuln/detail/CVE-2012-4439 · ADVISORY
bugzilla.redhat.com/show_bug.cgi · WEB
jenkinsci/jenkins · PACKAGE
security-tracker.debian.org/tracker/CVE-2012-4439 · WEB
cloudbees.com/jenkins-security-advisory-2012-09-17 · WEB
openwall.com/lists/oss-security/2012/09/21/2 · WEB

org.jenkins-ci.main:jenkins-core 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jenkins-ci.main:jenkins-core

Maven

≥ 1.467, < 1.482< 1.466.2

1.4821.466.2

jenkins

< 1.466.2< 1.482

1.466.21.482

Description

Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins.

NVD description

Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins.

org.jenkins-ci.main:jenkins-core 的其他漏洞

查看全部 →