medium
4.3
CWE
79
Advisory Published
Updated

CVE-2012-0324: XSS

First published: Fri Mar 09 2012(Updated: )

Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0325.

Credit: vultures@jpcert.or.jp

Affected SoftwareAffected VersionHow to fix
Jenkins=1.400
Jenkins=1.400.0.12
Jenkins=1.424
Jenkins=1.424.5
Jenkins=1.400
Jenkins=1.400.0.12
Jenkins<=1.453
Jenkins LTS=1.301
Jenkins LTS=1.302
Jenkins LTS=1.303
Jenkins LTS=1.304
Jenkins LTS=1.305
Jenkins LTS=1.306
Jenkins LTS=1.307
Jenkins LTS=1.308
Jenkins LTS=1.309
Jenkins LTS=1.310
Jenkins LTS=1.311
Jenkins LTS=1.312
Jenkins LTS=1.313
Jenkins LTS=1.314
Jenkins LTS=1.315
Jenkins LTS=1.316
Jenkins LTS=1.317
Jenkins LTS=1.318
Jenkins LTS=1.319
Jenkins LTS=1.320
Jenkins LTS=1.321
Jenkins LTS=1.322
Jenkins LTS=1.323
Jenkins LTS=1.324
Jenkins LTS=1.325
Jenkins LTS=1.326
Jenkins LTS=1.327
Jenkins LTS=1.328
Jenkins LTS=1.329
Jenkins LTS=1.330
Jenkins LTS=1.331
Jenkins LTS=1.332
Jenkins LTS=1.333
Jenkins LTS=1.334
Jenkins LTS=1.335
Jenkins LTS=1.336
Jenkins LTS=1.337
Jenkins LTS=1.338
Jenkins LTS=1.339
Jenkins LTS=1.340
Jenkins LTS=1.341
Jenkins LTS=1.342
Jenkins LTS=1.343
Jenkins LTS=1.344
Jenkins LTS=1.345
Jenkins LTS=1.346
Jenkins LTS=1.347
Jenkins LTS=1.348
Jenkins LTS=1.349
Jenkins LTS=1.350
Jenkins LTS=1.351
Jenkins LTS=1.352
Jenkins LTS=1.353
Jenkins LTS=1.354
Jenkins LTS=1.355
Jenkins LTS=1.356
Jenkins LTS=1.357
Jenkins LTS=1.358
Jenkins LTS=1.359
Jenkins LTS=1.360
Jenkins LTS=1.361
Jenkins LTS=1.362
Jenkins LTS=1.363
Jenkins LTS=1.364
Jenkins LTS=1.365
Jenkins LTS=1.366
Jenkins LTS=1.367
Jenkins LTS=1.368
Jenkins LTS=1.369
Jenkins LTS=1.370
Jenkins LTS=1.371
Jenkins LTS=1.372
Jenkins LTS=1.373
Jenkins LTS=1.374
Jenkins LTS=1.375
Jenkins LTS=1.376
Jenkins LTS=1.377
Jenkins LTS=1.378
Jenkins LTS=1.379
Jenkins LTS=1.380
Jenkins LTS=1.382
Jenkins LTS=1.383
Jenkins LTS=1.384
Jenkins LTS=1.386
Jenkins LTS=1.387
Jenkins LTS=1.388
Jenkins LTS=1.389
Jenkins LTS=1.390
Jenkins LTS=1.391
Jenkins LTS=1.392
Jenkins LTS=1.393
Jenkins LTS=1.394
Jenkins LTS=1.395
Jenkins LTS=1.396
Jenkins LTS=1.397
Jenkins LTS=1.398
Jenkins LTS=1.399
Jenkins LTS=1.400
Jenkins LTS=1.401
Jenkins LTS=1.402
Jenkins LTS=1.403
Jenkins LTS=1.404
Jenkins LTS=1.405
Jenkins LTS=1.406
Jenkins LTS=1.407
Jenkins LTS=1.408
Jenkins LTS=1.409
Jenkins LTS=1.409.1
Jenkins LTS=1.409.2
Jenkins LTS=1.410
Jenkins LTS=1.411
Jenkins LTS=1.412
Jenkins LTS=1.413
Jenkins LTS=1.414
Jenkins LTS=1.415
Jenkins LTS=1.416
Jenkins LTS=1.417
Jenkins LTS=1.418
Jenkins LTS=1.419
Jenkins LTS=1.420
Jenkins LTS=1.421
Jenkins LTS=1.422
Jenkins LTS=1.423
Jenkins LTS=1.424
Jenkins LTS=1.425
Jenkins LTS=1.426
Jenkins LTS=1.427
Jenkins LTS=1.428
Jenkins LTS=1.429
Jenkins LTS=1.430
Jenkins LTS=1.431
Jenkins LTS=1.432
Jenkins LTS=1.433
Jenkins LTS=1.434
Jenkins LTS=1.435
Jenkins LTS=1.436
Jenkins LTS=1.437

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2012-0324?

    CVE-2012-0324 has been classified as a moderate severity vulnerability due to its potential to allow remote code execution through cross-site scripting.

  • How do I fix CVE-2012-0324?

    To fix CVE-2012-0324, upgrade Jenkins to version 1.454 or later or update to Jenkins LTS 1.424.5 or later.

  • What types of software are affected by CVE-2012-0324?

    CVE-2012-0324 affects various versions of Jenkins, specifically those prior to versions 1.454, 1.424.5 for LTS, and 1.400.0.13 for Enterprise.

  • What can happen if CVE-2012-0324 is exploited?

    If exploited, CVE-2012-0324 can allow attackers to inject arbitrary web scripts or HTML into the web pages viewed by users.

  • Who is primarily impacted by CVE-2012-0324?

    Users of Jenkins versions below 1.454, including those using Jenkins LTS and Enterprise prior to specific patched releases, are primarily impacted by CVE-2012-0324.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203