CVE-2017-2601: XSS
Jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permission to configure jobs were able to inject JavaScript into parameter names and descriptions.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What access and conditions are required to exploit this issue?
An attacker needs permission to configure Jenkins jobs and must be able to persuade another user to view the affected parameter names or descriptions. The issue is remotely reachable, but it requires user interaction to trigger the injected script.
How can I determine whether my Jenkins instance may be affected?
Jenkins instances running a version earlier than 2.44 or 2.32.2 are affected if users can configure jobs and create malicious parameter names or descriptions. Review job configuration permissions and inspect parameter names and descriptions for unexpected script content.
What should be done if patching cannot be completed immediately?
Apply the available patch by upgrading to Jenkins 2.44, 2.32.2, or a later version. If upgrading cannot occur immediately, restrict job configuration permissions to trusted users and review existing job parameters and descriptions for injected JavaScript.