Описание
Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.
A flaw was found in Jenkins. This vulnerability, identified as a stored cross-site scripting (XSS) issue, occurs because Jenkins does not properly escape the user-provided description for the "Mark temporarily offline" cause. An attacker with Agent/Configure or Agent/Disconnect permissions can exploit this to inject malicious scripts, leading to potential information disclosure or unauthorized actions within the user's browser.
Отчет
This vulnerability in Jenkins allows authenticated attackers with Agent/Configure or Agent/Disconnect permissions to inject malicious scripts into the "Mark temporarily offline" cause description. This stored cross-site scripting (XSS) flaw can lead to information disclosure or unauthorized actions within a user's browser when viewing the affected description. Red Hat OpenShift Developer Tools & Services are affected.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Developer Tools and Services | jenkins | Fix deferred | ||
| OpenShift Developer Tools and Services 4.12 | ocp-tools-4/jenkins-rhel8 | Fixed | RHSA-2026:10209 | 23.04.2026 |
| OpenShift Developer Tools and Services 4.13 | ocp-tools-4/jenkins-rhel8 | Fixed | RHSA-2026:10201 | 23.04.2026 |
| OpenShift Developer Tools and Services 4.14 | ocp-tools-4/jenkins-rhel8 | Fixed | RHSA-2026:10211 | 23.04.2026 |
| OpenShift Developer Tools and Services 4.15 | ocp-tools-4/jenkins-rhel8 | Fixed | RHSA-2026:10204 | 23.04.2026 |
| OpenShift Developer Tools and Services 4.16 | ocp-tools-4/jenkins-rhel9 | Fixed | RHSA-2026:10214 | 23.04.2026 |
| OpenShift Developer Tools and Services 4.17 | ocp-tools-4/jenkins-rhel9 | Fixed | RHSA-2026:10213 | 23.04.2026 |
| OpenShift Developer Tools and Services 4.18 | ocp-tools-4/jenkins-rhel9 | Fixed | RHSA-2026:10215 | 23.04.2026 |
| OpenShift Developer Tools and Services 4.19 | ocp-tools-4/jenkins-rhel9 | Fixed | RHSA-2026:10206 | 23.04.2026 |
| OpenShift Developer Tools and Services 4.2 | ocp-tools-4/jenkins-rhel9 | Fixed | RHSA-2026:10205 | 23.04.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.6 Medium
CVSS3
Связанные уязвимости
Jenkins 2.483 through 2.550 (both inclusive), LTS 2.492.1 through 2.541.1 (both inclusive) does not escape the user-provided description of the "Mark temporarily offline" offline cause, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure or Agent/Disconnect permission.
Jenkins has a stored XSS vulnerability in node offline cause description
Уязвимость сервера автоматизации Jenkins связана с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю выполнить произвольный код
EPSS
4.6 Medium
CVSS3