CVE-2012-0325

Jenkins allows Cross-Site Scripting (XSS)

4.3 MediumFix available

Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0324.

Exploit likelihood

1.03%Down 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2012-0325
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-0325
Updated: 2026-11-02

EUVDEUVD-2012-0361 No score

Record: EUVD-2012-0361
Updated: 2026-11-03

GitHub AdvisoriesGHSA-cc55-c9j4-m7cx 2.1

Jenkins allows Cross-Site Scripting (XSS)

Record: GHSA-cc55-c9j4-m7cx
CVSS 4.0: 2.1 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-cc55-c9j4-m7cx 2.1

Jenkins allows Cross-Site Scripting (XSS)

Record: GHSA-cc55-c9j4-m7cx
CVSS 4.0: 2.1 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.main:jenkins-core` Maven	1.425 up to 1.454	1.454
`org.jenkins-ci.main:jenkins-core` Maven	before 1.424.5	1.424.5
`org.jenkins-ci.main:jenkins-core` Maven	1.425 up to 1.454, plus listed versions 1.4261.4271.4281.4291.430 Show 25 moreShow less 1.4311.4321.4331.4341.4351.4361.4371.4381.4391.4401.4411.4421.4431.4441.4451.4461.4471.447.11.447.21.4481.4491.4501.4511.4521.453	1.454
`org.jenkins-ci.main:jenkins-core` Maven	before 1.424.5, plus listed versions 1.3961.3971.3981.3991.400 Show 30 moreShow less 1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.4	1.424.5

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-0325 is a medium vulnerability (CVSS 4.3) in Cloudbees Jenkins, published March 9, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 63rd percentile. Fixed in org.jenkins-ci.main:jenkins-core 1.454.