CVE-2026-53441

Опубликовано: 10 июн. 2026

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the POST config.xml API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

Ссылки

https://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3731
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*

Версия от 2.483 (включая) до 2.568 (исключая)

cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*

Версия от 2.492.1 (включая) до 2.555.3 (исключая)

EPSS

Процентиль: 18%

0.00261

Низкий

5.4 Medium

CVSS3

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

CVE-2026-53441

CVSS3: 5.4

redhat

около 2 месяцев назад

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

GHSA-93qh-vwrm-c5pw

CVSS3: 8

github

около 2 месяцев назад

Jenkins: Stored XSS vulnerability in node offline cause description

EPSS

Процентиль: 18%

0.00261

Низкий

5.4 Medium

CVSS3

5.4 Medium

CVSS3

Дефекты

CWE-79