CVE-2023-27898
Cross-site Scripting vulnerability in Jenkins
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
- Record
CVE-2023-27898- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
- Record
CVE-2023-27898- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-1045
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
- Record
EUVD-2023-1045- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j664-qhh4-hpf8
Cross-site Scripting vulnerability in Jenkins
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
- Record
GHSA-j664-qhh4-hpf8- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
- Record
CVE-2023-27898- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-j664-qhh4-hpf8
Cross-site Scripting vulnerability in Jenkins
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
- Record
GHSA-j664-qhh4-hpf8- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVRHSA-2023:1655
Red Hat Security Advisory: OpenShift Container Platform 4.10.56 security update
- Record
RHSA-2023:1655- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:3663
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2023:3663- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-jenkins-2023-27898 No score
Jenkins LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
- Record
BIT-jenkins-2023-27898- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven |
2.376 up to 2.394 | 2.394 |
org.jenkins-ci.main:jenkins-coreMaven |
before 2.375.4 | 2.375.4 |
jenkinsBitnami |
2.270.0 up to 2.394.0 | 2.394.0 |
org.jenkins-ci.main:jenkins-coreMaven |
2.376 up to 2.394, plus listed versions 2.3772.3782.3792.3802.381 Show 15 moreShow less2.3822.3832.3842.3852.3862.3872.387.12.387.22.387.32.3882.3892.3902.3912.3922.393 |
2.394 |
org.jenkins-ci.main:jenkins-coreMaven |
before 2.375.4, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 |
2.375.4 |
openshiftRed Hat:openshift:4.10::el7 From an advisory covering 10 CVEs |
before 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7 | 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7 |
openshift-hyperkubeRed Hat:openshift:4.10::el7 From an advisory covering 10 CVEs |
before 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7 | 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el7 |
openshiftRed Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8 | 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8 |
openshift-hyperkubeRed Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8 | 0:4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8 |
jenkinsRed Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:2.387.1.1680701869-1.el8 | 0:2.387.1.1680701869-1.el8 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jenkins-2-pluginsRed Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:4.10.1680703106-1.el8 | 0:4.10.1680703106-1.el8 |
haproxyRed Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:2.2.19-4.el8 | 0:2.2.19-4.el8 |
haproxy-debugsourceRed Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:2.2.19-4.el8 | 0:2.2.19-4.el8 |
haproxy22Red Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:2.2.19-4.el8 | 0:2.2.19-4.el8 |
haproxy22-debuginfoRed Hat:openshift:4.10::el8 From an advisory covering 10 CVEs |
before 0:2.2.19-4.el8 | 0:2.2.19-4.el8 |
jenkinsRed Hat:ocp_tools:4.11::el8 From an advisory covering 17 CVEs |
before 0:2.401.1.1686831596-3.el8 | 0:2.401.1.1686831596-3.el8 |
jenkins-2-pluginsRed Hat:ocp_tools:4.11::el8 From an advisory covering 17 CVEs |
before 0:4.11.1686831822-1.el8 | 0:4.11.1686831822-1.el8 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-27898 is a critical vulnerability (CVSS 9.6) in Jenkins, published March 8, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. Fixed in org.jenkins-ci.main:jenkins-core 2.394.
References
jenkins.io/security/advisory/2023-03-08
nvd.nist.gov/vuln/detail/CVE-2023-27898
github.com/jenkinsci/jenkins/commit/59ac866d9946d7c296023da0ea78baafd4cf71eb
access.redhat.com/errata/RHSA-2023:1655
Show 114 moreShow less
docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html
bugzilla.redhat.com/show_bug.cgi?id=2127804
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1655.json
cve.org/CVERecord?id=CVE-2022-3172
spring.io/security/cve-2022-31690
blogs.apache.org/security/entry/cve-2022-42889
lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
seclists.org/oss-sec/2022/q4/22
haproxy.com/blog/february-2023-header-parser-fixed
mail-archive.com/[email protected]/msg43229.html
tanzu.vmware.com/security/cve-2022-22976
research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633
ibm.com/support/pages/security-bulletin-vulnerability-log4j-1216jar-affect-ibm-operations-analytics-log-analysis-cve-2023-26464
Left out here: 744 versions. The JSON record has them.