CVE-2023-35146

MediumCVSS 5.4

Published: 14/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.75%

50th percentile - higher than 50% of all known CVEs

Summary

Jenkins Template Workflows Plugin version 41.v32d86a_313b_4a and earlier does not escape names of jobs used as building blocks for Template Workflow Jobs, leading to a stored XSS vulnerability.

Risk Assessment

Attackers can exploit this vulnerability to inject malicious JavaScript code, potentially leading to data theft or session hijacking.

Recommendation

It is recommended to update the plugin to the latest version to mitigate this vulnerability and to review and monitor jobs for potential attacks.

Original NVD description (English source)

Jenkins Template Workflows Plugin 41.v32d86a_313b_4a and earlier does not escape names of jobs used as buildings blocks for Template Workflow Job, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create jobs.