CVE-2023-41931
XSS vulnerability in Jenkins Job Configuration History Plugin
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendering a history entry on the history view, resulting in a stored cross-site scripting (XSS) vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendering a history entry on the history view, resulting in a stored cross-site scripting (XSS) vulnerability.
- Record
CVE-2023-41931- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendering a history entry on the history view, resulting in a stored cross-site scripting (XSS) vulnerability.
- Record
CVE-2023-41931- Updated
- 2026-11-02
EUVDEUVD-2023-2437
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendering a history entry on the history view, resulting in a stored cross-site scripting (XSS) vulnerability.
- Record
EUVD-2023-2437- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5jxp-f5rr-g6jc
XSS vulnerability in Jenkins Job Configuration History Plugin
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendering a history entry on the history view, resulting in a stored cross-site scripting (XSS) vulnerability.
- Record
GHSA-5jxp-f5rr-g6jc- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-5jxp-f5rr-g6jc
XSS vulnerability in Jenkins Job Configuration History Plugin
Jenkins Job Configuration History Plugin 1227.v7a_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from history entries when rendering a history entry on the history view, resulting in a stored cross-site scripting (XSS) vulnerability.
- Record
GHSA-5jxp-f5rr-g6jc- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.plugins:jobConfigHistoryMaven | through 1227.v7a | 1229.v3039470161a_d |
org.jenkins-ci.plugins:jobConfigHistoryMaven | before 1229.v3039470161a_d, plus listed versions 1.101.111.121.131119.v509e1017356b_ Show 45 moreShow less1133.v0f5420f850531139.v888b_656ca_f6d1146.v94c2521f92131148.v8607da_ef251e1155.v28a_46a_cc06a_51156.v536a_97b_8d6491163.ve82c7c6e60a_31165.v8cc9fd1f45971166.vc9f255f45b_8a1170.v8a_c085b_dd49c1171.v04b_66d78555e1176.v1b_4290db_41a_51183.v6e2785ff75e01187.v2a_b_1ca_54d18d1191.v168c8c2b_956a1198.v4d5736c2308c1206.vc8967cc8a_2cb_1207.vd28a_54732f921212.vd4470d08ff121227.v7a_79fc4dc01f2.02.12.1.12.102.112.122.132.142.152.162.172.182.18.12.18.22.18.32.192.22.202.212.222.232.23.12.242.252.26 | 1229.v3039470161a_d |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-41931 is a medium vulnerability (CVSS 5.4) in Jenkins Job Configuration History, published September 6, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in org.jenkins-ci.plugins:jobConfigHistory 1229.v3039470161a_d.
References
Left out here: 16 versions. The JSON record has them.