Every CVE Search/ Get API key

CVE-2013-5573

Jenkins allows Cross-Site Scripting (XSS) in User Configuration

4.3 MediumPublic exploitFix available

CVE-2013-5573 is a medium vulnerability (CVSS 4.3) in Jenkins, published December 31, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.41%, the 92nd percentile. Fixed in jenkins 0:1.565.3-1.el6op.

Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.

Exploit likelihood

5.41%Up 3.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.

Record
CVE-2013-5573
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.

Record
CVE-2013-5573
Updated
2026-11-02
EUVDEUVD-2013-5413 No score

Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.

Record
EUVD-2013-5413
Updated
2026-11-03
GitHub AdvisoriesGHSA-52g6-pfrq-rxfv 2.1

Jenkins allows Cross-Site Scripting (XSS) in User Configuration

Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.

Record
GHSA-52g6-pfrq-rxfv
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-52g6-pfrq-rxfv 2.1

Jenkins allows Cross-Site Scripting (XSS) in User Configuration

Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.

Record
GHSA-52g6-pfrq-rxfv
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.jenkins-ci.main:jenkins-core
Maven
 through 1.523 None known
org.jenkins-ci.main:jenkins-core
Maven
 through 1.523, plus listed versions
1.3961.3971.3981.3991.400
Show 45 moreShow less
1.4011.4031.4041.4051.4061.4071.4081.4091.409.11.409.21.409.31.4101.4111.4121.4131.4141.4151.4161.4171.4181.4191.4201.4211.4221.4231.4241.424.11.424.21.424.31.424.41.424.51.424.61.4251.4261.4271.4281.4291.4301.4311.4321.4331.4341.4351.4361.437
 None known
jenkins
Red Hat:openshift:2.0::el6
 before 0:1.565.3-1.el6op
0:1.565.3-1.el6op
jenkins-plugin-openshift
Red Hat:openshift:2.0::el6
 before 0:0.6.40.1-0.el6op
0:0.6.40.1-0.el6op
openshift-origin-cartridge-jenkins
Red Hat:openshift:2.0::el6
 before 0:1.20.3.5-1.el6op
0:1.20.3.5-1.el6op

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBJenkins 1.523 - Persistent HTML Code2013-12-18

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References

Show 95 moreShow less
This page doesn't list everything

Left out here: 101 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open