CVE-2023-41931: XSS
First published: Wed Sep 06 2023(Updated: )
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendering a history entry on the history view, resulting in a stored cross-site scripting (XSS) vulnerability.
Credit: jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com jenkinsci-cert@googlegroups.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jenkins Job Configuration History | <=1227.v7a_79fc4dc01f | |
| maven/org.jenkins-ci.plugins:jobConfigHistory | <=1227.v7a | 1229.v3039470161a_d |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Jenkins Job Configuration History Plugin vulnerability?
The vulnerability ID for this Jenkins Job Configuration History Plugin vulnerability is CVE-2023-41931.
What is the severity level of CVE-2023-41931?
The severity level of CVE-2023-41931 is medium (5.4).
How does CVE-2023-41931 affect the software?
CVE-2023-41931 affects Jenkins Job Configuration History Plugin version 1227.v7a_79fc4dc01f and earlier.
What is the CWE category for CVE-2023-41931?
The CWE category for CVE-2023-41931 is CWE-79 (Cross-Site Scripting).
How can I fix CVE-2023-41931?
To fix CVE-2023-41931, update Jenkins Job Configuration History Plugin to a version later than 1227.v7a_79fc4dc01f.
- collector/nvd-api
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-5jxp-f5rr-g6jc
- alias/CVE-2023-41931
- agent/software-canonical-lookup
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/description
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- agent/event
- collector/github-advisory
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/jenkins
- canonical/jenkins job configuration history
- version/jenkins job configuration history/1227.v7a_79fc4dc01f
- package-manager/maven