CVE-2012-0324
Jenkins allows Cross-Site Scripting (XSS)
CVE-2012-0324 is a medium vulnerability (CVSS 4.3) in Cloudbees Jenkins, published March 9, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 64th percentile. Fixed in org.jenkins-ci.main:jenkins-core 1.454.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 1.03%EPSS, 64th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.454org.jenkins-ci.main:jenkins-core +3 more
Description
Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0325.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven | 1.425 up to 1.454 | 1.454 |
org.jenkins-ci.main:jenkins-coreMaven | before 1.424.5 | 1.424.5 |
org.jenkins-ci.main:jenkins-coreMaven | 1.425 up to 1.454, plus listed versions 1.4261.4271.4281.4291.430 Show 25 moreShow less1.4311.4321.4331.4341.4351.4361.4371.4381.4391.4401.4411.4421.4431.4441.4451.4461.4471.447.11.447.21.4481.4491.4501.4511.4521.453 | 1.454 |
org.jenkins-ci.main:jenkins-coreMaven | before 1.424.5, plus listed versions 1.3961.3971.3981.3991.400 Show 30 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.4 | 1.424.5 |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0325.
- Record
CVE-2012-0324- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0325.
- Record
CVE-2012-0324- Updated
- 2026-11-02
EUVDEUVD-2012-0360No score
Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0325.
- Record
EUVD-2012-0360- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4w4h-8qh9-342x
Jenkins allows Cross-Site Scripting (XSS)
Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0325.
- Record
GHSA-4w4h-8qh9-342x- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-4w4h-8qh9-342x
Jenkins allows Cross-Site Scripting (XSS)
Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0325.
- Record
GHSA-4w4h-8qh9-342x- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
jvndb.jvn.jp/jvndb/JVNDB-2012-000022
cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-03-05.cb
securityfocus.com/bid/52384
jvn.jp/en/jp/JVN14791558/index.html
nvd.nist.gov/vuln/detail/CVE-2012-0324
web.archive.org/web/20200229025003/https://www.securityfocus.com/bid/52384
github.com/advisories/GHSA-4w4h-8qh9-342x