Every CVE Search/ Get API key

CVE-2011-4344

Jenkins allows Cross-Site Scripting (XSS)

2.6 LowFix available

Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.

Exploit likelihood

1.23%Down 0.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 2.6

Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.

Record
CVE-2011-4344
CVSS 2.0
2.6 LowAV:N/AC:H/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.

Record
CVE-2011-4344
Updated
2026-11-02
EUVDEUVD-2011-4275 No score

Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.

Record
EUVD-2011-4275
Updated
2026-11-03
GitHub AdvisoriesGHSA-q3rp-555r-hh6r 2.1

Jenkins allows Cross-Site Scripting (XSS)

Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.

Record
GHSA-q3rp-555r-hh6r
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-q3rp-555r-hh6r 2.1

Jenkins allows Cross-Site Scripting (XSS)

Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.

Record
GHSA-q3rp-555r-hh6r
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2011-4344 No score

Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.

Record
UBUNTU-CVE-2011-4344
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.main:jenkins-core
Maven
 before 1.409.3
1.409.3
org.jenkins-ci.main:jenkins-core
Maven
 1.410 up to 1.438
1.438
org.jenkins-ci.main:jenkins-core
Maven
 before 1.409.3, plus listed versions
1.3961.3971.3981.3991.400
Show 10 moreShow less
1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.2
1.409.3
org.jenkins-ci.main:jenkins-core
Maven
 1.410 up to 1.438, plus listed versions
1.4111.4121.4131.4141.415
Show 28 moreShow less
1.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437
1.438

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-4344 is a low vulnerability (CVSS 2.6) in Jenkins, published December 1, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 69th percentile. Fixed in org.jenkins-ci.main:jenkins-core 1.409.3.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open