CVE-2023-43495: XSS
ExpandableDetailsNote allows annotating build log content with additional information that can be revealed when interacted with.
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the caption constructor parameter of ExpandableDetailsNote.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide caption parameter values.
As of publication, the related API is not used within Jenkins (core), and the Jenkins security team is not aware of any affected plugins. Jenkins 2.424, LTS 2.414.2 escapes caption constructor parameter values.
Other sources
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter.
Jenkins weekly and LTS are vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the caption constructor parameter of ExpandableDetailsNote. A remote authenticated attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-43495?
CVE-2023-43495 is a vulnerability in Jenkins 2.423 and earlier LTS 2.414.1 and earlier that allows an attacker to execute arbitrary code.
How does CVE-2023-43495 impact my system?
CVE-2023-43495 can result in a store XSS vulnerability, allowing an attacker to inject malicious code into the Jenkins build log.
Which software versions are affected by CVE-2023-43495?
Jenkins versions 2.423 and earlier, as well as LTS versions 2.414.1 and earlier are affected.
What is the severity of CVE-2023-43495?
CVE-2023-43495 has a severity rating of 8, which is considered high.
How can I mitigate the vulnerability CVE-2023-43495?
To mitigate CVE-2023-43495, update your Jenkins installation to version 2.424 or higher.