CVE-2023-40346

MediumCVSS 5.4

Published: 16/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

33th percentile - higher than 33% of all known CVEs

Summary

Jenkins Shortcut Job Plugin version 0.4 and earlier does not escape the shortcut redirection URL, leading to a stored cross-site scripting (XSS) vulnerability that can be exploited by attackers able to configure shortcut jobs.

Risk Assessment

Attackers can exploit this vulnerability to inject malicious JavaScript code, potentially leading to user data theft or session hijacking.

Recommendation

It is recommended to update the Jenkins Shortcut Job Plugin to the latest version to mitigate this vulnerability and implement appropriate XSS protection measures.

Original NVD description (English source)

Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure shortcut jobs.