CVE-2023-40350: XSS
Jenkins Docker Swarm Plugin 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboard view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control responses from Docker.
Other sources
Jenkins Docker Swarm Plugin processes Docker responses to generate the Docker Swarm Dashboard view.
Docker Swarm Plugin 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboard view. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control responses from Docker.
As of publication of this advisory, there is no fix.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-40350.
What is the severity of CVE-2023-40350?
The severity of CVE-2023-40350 is high with a severity value of 7.5.
What is the affected software for CVE-2023-40350?
The affected software for CVE-2023-40350 is Jenkins Docker Swarm Plugin version 1.11 and earlier.
What is the CWE ID for CVE-2023-40350?
The CWE ID for CVE-2023-40350 is CWE-79.
How can I fix CVE-2023-40350?
To fix CVE-2023-40350, you should upgrade to a version of Jenkins Docker Swarm Plugin that is not affected by the vulnerability.