CVE-2012-6074

Jenkins allows Cross-Site Scripting (XSS)

3.5 LowFix available

CVE-2012-6074 is a low vulnerability (CVSS 3.5) in Cloudbees Jenkins, published February 24, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.42%, the 72nd percentile. Fixed in org.jenkins-ci.main:jenkins-core 1.491.

Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.

Exploit likelihood

1.42%Up 0.3 points since Feb 4, 2022

What each source reports

NVD Score used 3.5

Record: CVE-2012-6074
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2012-6074
Updated: 2026-11-02

EUVDEUVD-2012-5948 No score

Record: EUVD-2012-5948
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9hr6-5x6g-gg5g 2.3

Jenkins allows Cross-Site Scripting (XSS)

Record: GHSA-9hr6-5x6g-gg5g
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-9hr6-5x6g-gg5g 2.3

Jenkins allows Cross-Site Scripting (XSS)

Record: GHSA-9hr6-5x6g-gg5g
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.jenkins-ci.main:jenkins-core` Maven	1.481 up to 1.491	1.491
`org.jenkins-ci.main:jenkins-core` Maven	before 1.480.1	1.480.1
`org.jenkins-ci.main:jenkins-core` Maven	1.481 up to 1.491, plus listed versions 1.4821.4831.4841.4851.486 Show 4 moreShow less 1.4871.4881.4891.490	1.491
`org.jenkins-ci.main:jenkins-core` Maven	before 1.480.1, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less 1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437	1.480.1
`rhc` Red Hat:openshift:1::el6	before 0:1.3.2-1.3.el6op	0:1.3.2-1.3.el6op
`libmongodb` Red Hat:openshift:1::el6	before 0:2.0.2-6.el6op	0:2.0.2-6.el6op
`mongodb` Red Hat:openshift:1::el6	before 0:2.0.2-6.el6op	0:2.0.2-6.el6op
`mongodb-debuginfo` Red Hat:openshift:1::el6	before 0:2.0.2-6.el6op	0:2.0.2-6.el6op
`mongodb-devel` Red Hat:openshift:1::el6	before 0:2.0.2-6.el6op	0:2.0.2-6.el6op
`mongodb-server` Red Hat:openshift:1::el6	before 0:2.0.2-6.el6op	0:2.0.2-6.el6op

Show 28 moreShow less

Affected packages
Package	Affected	Fixed
`openshift-console` Red Hat:openshift:1::el6	before 0:0.0.13-2.el6op	0:0.0.13-2.el6op
`openshift-origin-broker` Red Hat:openshift:1::el6	before 0:1.0.10-1.el6op	0:1.0.10-1.el6op
`openshift-origin-broker-util` Red Hat:openshift:1::el6	before 0:1.0.14-1.el6op	0:1.0.14-1.el6op
`ruby193-mod_passenger` Red Hat:openshift:1::el6	before 0:3.0.12-21.el6op	0:3.0.12-21.el6op
`ruby193-rubygem-activerecord` Red Hat:openshift:1::el6	before 1:3.2.8-2.el6	1:3.2.8-2.el6
`ruby193-rubygem-activerecord-doc` Red Hat:openshift:1::el6	before 1:3.2.8-2.el6	1:3.2.8-2.el6
`ruby193-rubygem-passenger` Red Hat:openshift:1::el6	before 0:3.0.12-21.el6op	0:3.0.12-21.el6op
`ruby193-rubygem-passenger-debuginfo` Red Hat:openshift:1::el6	before 0:3.0.12-21.el6op	0:3.0.12-21.el6op
`ruby193-rubygem-passenger-devel` Red Hat:openshift:1::el6	before 0:3.0.12-21.el6op	0:3.0.12-21.el6op
`ruby193-rubygem-passenger-doc` Red Hat:openshift:1::el6	before 0:3.0.12-21.el6op	0:3.0.12-21.el6op
`ruby193-rubygem-passenger-native` Red Hat:openshift:1::el6	before 0:3.0.12-21.el6op	0:3.0.12-21.el6op
`ruby193-rubygem-passenger-native-libs` Red Hat:openshift:1::el6	before 0:3.0.12-21.el6op	0:3.0.12-21.el6op
`rubygem-activerecord` Red Hat:openshift:1::el6	before 1:3.0.13-3.el6op	1:3.0.13-3.el6op
`rubygem-openshift-origin-auth-remote-user` Red Hat:openshift:1::el6	before 0:1.0.4-2.el6op	0:1.0.4-2.el6op
`rubygem-openshift-origin-common` Red Hat:openshift:1::el6	before 0:1.0.2-1.el6op	0:1.0.2-1.el6op
`rubygem-openshift-origin-console` Red Hat:openshift:1::el6	before 0:1.0.6-1.el6op	0:1.0.6-1.el6op
`rubygem-openshift-origin-console-doc` Red Hat:openshift:1::el6	before 0:1.0.6-1.el6op	0:1.0.6-1.el6op
`rubygem-openshift-origin-controller` Red Hat:openshift:1::el6	before 0:1.0.11-1.el6op	0:1.0.11-1.el6op
`rubygem-openshift-origin-dns-bind` Red Hat:openshift:1::el6	before 0:1.0.2-1.el6op	0:1.0.2-1.el6op
`rubygem-openshift-origin-msg-broker-mcollective` Red Hat:openshift:1::el6	before 0:1.0.4-1.el6op	0:1.0.4-1.el6op
`jenkins` Red Hat:openshift:1::el6	before 0:1.498-1.1.el6op	0:1.498-1.1.el6op
`openshift-origin-cartridge-haproxy-1.4` Red Hat:openshift:1::el6	before 0:1.0.3-1.el6op	0:1.0.3-1.el6op
`openshift-origin-cartridge-ruby-1.8` Red Hat:openshift:1::el6	before 0:1.0.5-1.el6op	0:1.0.5-1.el6op
`openshift-origin-cartridge-ruby-1.9-scl` Red Hat:openshift:1::el6	before 0:1.0.5-1.el6op	0:1.0.5-1.el6op
`openshift-origin-msg-node-mcollective` Red Hat:openshift:1::el6	before 0:1.0.2-1.el6op	0:1.0.2-1.el6op
`openshift-origin-node-util` Red Hat:openshift:1::el6	before 0:1.0.7-1.el6op	0:1.0.7-1.el6op
`openshift-origin-port-proxy` Red Hat:openshift:1::el6	before 0:1.0.3-1.el6op	0:1.0.3-1.el6op
`rubygem-openshift-origin-node` Red Hat:openshift:1::el6	before 0:1.0.10-6.el6op	0:1.0.10-6.el6op