CVE-2023-27898: XSS
A flaw was found in Jenkins. Affected versions of Jenkins do not escape the Jenkins version that a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins in the plugin manager. This issue results in a stored Cross-site scripting (XSS) vulnerability, exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
Other sources
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2023-27898?
The severity of CVE-2023-27898 is high, with a severity value of 8.8.
Which versions of Jenkins are affected by CVE-2023-27898?
Jenkins versions 2.270 through 2.393 (inclusive) and LTS versions 2.277.1 through 2.375.3 (inclusive) are affected by CVE-2023-27898.
How does CVE-2023-27898 impact Jenkins?
CVE-2023-27898 is a stored Cross-site scripting (XSS) vulnerability that allows an attacker to execute malicious scripts in the affected version of Jenkins.
Is there a fix available for CVE-2023-27898?
Yes, the remedy for CVE-2023-27898 is to upgrade Jenkins to version 2.394 or higher.
Where can I find more information about CVE-2023-27898?
You can find more information about CVE-2023-27898 in the following references: [https://www.cve.org/CVERecord?id=CVE-2023-27898](https://www.cve.org/CVERecord?id=CVE-2023-27898), [https://nvd.nist.gov/vuln/detail/CVE-2023-27898](https://nvd.nist.gov/vuln/detail/CVE-2023-27898), [https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3037](https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3037), [https://bugzilla.redhat.com/show_bug.cgi?id=2177629](https://bugzilla.redhat.com/show_bug.cgi?id=2177629), [https://access.redhat.com/errata/RHSA-2023:1655](https://access.redhat.com/errata/RHSA-2023:1655).