CVE-2012-6074
Jenkins allows Cross-Site Scripting (XSS)
CVE-2012-6074 is a low vulnerability (CVSS 3.5) in Cloudbees Jenkins, published February 24, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.42%, the 73rd percentile. Fixed in org.jenkins-ci.main:jenkins-core 1.491.
- Severity
- 3.5 LowCVSS 2.0, NVD
- Exploit chance
- 1.42%EPSS, 73rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.491org.jenkins-ci.main:jenkins-core +37 more
Description
Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.jenkins-ci.main:jenkins-coreMaven | 1.481 up to 1.491 | 1.491 |
org.jenkins-ci.main:jenkins-coreMaven | before 1.480.1 | 1.480.1 |
org.jenkins-ci.main:jenkins-coreMaven | 1.481 up to 1.491, plus listed versions 1.4821.4831.4841.4851.486 Show 4 moreShow less1.4871.4881.4891.490 | 1.491 |
org.jenkins-ci.main:jenkins-coreMaven | before 1.480.1, plus listed versions 1.3961.3971.3981.3991.400 Show 45 moreShow less1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437 | 1.480.1 |
rhcRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.3.2-1.3.el6op | 0:1.3.2-1.3.el6op |
libmongodbRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:2.0.2-6.el6op | 0:2.0.2-6.el6op |
mongodbRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:2.0.2-6.el6op | 0:2.0.2-6.el6op |
mongodb-debuginfoRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:2.0.2-6.el6op | 0:2.0.2-6.el6op |
mongodb-develRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:2.0.2-6.el6op | 0:2.0.2-6.el6op |
mongodb-serverRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:2.0.2-6.el6op | 0:2.0.2-6.el6op |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openshift-consoleRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:0.0.13-2.el6op | 0:0.0.13-2.el6op |
openshift-origin-brokerRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.10-1.el6op | 0:1.0.10-1.el6op |
openshift-origin-broker-utilRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.14-1.el6op | 0:1.0.14-1.el6op |
ruby193-mod_passengerRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:3.0.12-21.el6op | 0:3.0.12-21.el6op |
ruby193-rubygem-activerecordRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 1:3.2.8-2.el6 | 1:3.2.8-2.el6 |
ruby193-rubygem-activerecord-docRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 1:3.2.8-2.el6 | 1:3.2.8-2.el6 |
ruby193-rubygem-passengerRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:3.0.12-21.el6op | 0:3.0.12-21.el6op |
ruby193-rubygem-passenger-debuginfoRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:3.0.12-21.el6op | 0:3.0.12-21.el6op |
ruby193-rubygem-passenger-develRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:3.0.12-21.el6op | 0:3.0.12-21.el6op |
ruby193-rubygem-passenger-docRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:3.0.12-21.el6op | 0:3.0.12-21.el6op |
ruby193-rubygem-passenger-nativeRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:3.0.12-21.el6op | 0:3.0.12-21.el6op |
ruby193-rubygem-passenger-native-libsRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:3.0.12-21.el6op | 0:3.0.12-21.el6op |
rubygem-activerecordRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 1:3.0.13-3.el6op | 1:3.0.13-3.el6op |
rubygem-openshift-origin-auth-remote-userRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.4-2.el6op | 0:1.0.4-2.el6op |
rubygem-openshift-origin-commonRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.2-1.el6op | 0:1.0.2-1.el6op |
rubygem-openshift-origin-consoleRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.6-1.el6op | 0:1.0.6-1.el6op |
rubygem-openshift-origin-console-docRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.6-1.el6op | 0:1.0.6-1.el6op |
rubygem-openshift-origin-controllerRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.11-1.el6op | 0:1.0.11-1.el6op |
rubygem-openshift-origin-dns-bindRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.2-1.el6op | 0:1.0.2-1.el6op |
rubygem-openshift-origin-msg-broker-mcollectiveRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.4-1.el6op | 0:1.0.4-1.el6op |
jenkinsRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.498-1.1.el6op | 0:1.498-1.1.el6op |
openshift-origin-cartridge-haproxy-1.4Red Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.3-1.el6op | 0:1.0.3-1.el6op |
openshift-origin-cartridge-ruby-1.8Red Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.5-1.el6op | 0:1.0.5-1.el6op |
openshift-origin-cartridge-ruby-1.9-sclRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.5-1.el6op | 0:1.0.5-1.el6op |
openshift-origin-msg-node-mcollectiveRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.2-1.el6op | 0:1.0.2-1.el6op |
openshift-origin-node-utilRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.7-1.el6op | 0:1.0.7-1.el6op |
openshift-origin-port-proxyRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.3-1.el6op | 0:1.0.3-1.el6op |
rubygem-openshift-origin-nodeRed Hat:openshift:1::el6 From an advisory covering 7 CVEs | before 0:1.0.10-6.el6op | 0:1.0.10-6.el6op |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.
- Record
CVE-2012-6074- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.
- Record
CVE-2012-6074- Updated
- 2026-11-02
EUVDEUVD-2012-5948No score
Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.
- Record
EUVD-2012-5948- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9hr6-5x6g-gg5g
Jenkins allows Cross-Site Scripting (XSS)
Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.
- Record
GHSA-9hr6-5x6g-gg5g- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-9hr6-5x6g-gg5g
Jenkins allows Cross-Site Scripting (XSS)
Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.
- Record
GHSA-9hr6-5x6g-gg5g- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
rhn.redhat.com/errata/RHSA-2013-0220.html
openwall.com/lists/oss-security/2012/12/28/1
wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2012-11-20
bugzilla.redhat.com/show_bug.cgi?id=890612
cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-11-20.cb
nvd.nist.gov/vuln/detail/CVE-2012-6074
Show 68 moreShow less
access.redhat.com/errata/RHSA-2013:0220
github.com/advisories/GHSA-9hr6-5x6g-gg5g
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0220.json
cve.org/CVERecord?id=CVE-2012-5658
phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html
Left out here: 47 versions. The JSON record has them.