CVE-2023-35143

MediumCVSS 5.4

Published: 14/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.62%

45th percentile - higher than 45% of all known CVEs

Summary

Jenkins Maven Repository Server Plugin version 1.10 and earlier does not escape the versions of build artifacts on the Build Artifacts As Maven Repository page, resulting in a stored XSS vulnerability.

Risk Assessment

Attackers can exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.

Recommendation

It is recommended to update the Jenkins Maven Repository Server Plugin to the latest version to mitigate this vulnerability and implement appropriate safeguards against XSS attacks.

Original NVD description (English source)

Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape the versions of build artifacts on the Build Artifacts As Maven Repository page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control maven project versions in `pom.xml`.