CVE-2023-39151
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Jenkins versions 2.415 and earlier, and LTS 2.401.2 and earlier do not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored XSS vulnerability exploitable by attackers able to control build log contents.
Risk Assessment
Attackers can exploit this vulnerability to inject malicious JavaScript code into build logs, potentially leading to data theft or session hijacking.
Recommendation
It is recommended to update Jenkins to the latest version to mitigate this vulnerability and review build logs for potential attacks.
Original NVD description (English source)
Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control build log contents.