CVE-2023-43495
Summary
| CVE | CVE-2023-43495 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-09-20 17:15:00 UTC |
| Updated | 2023-09-23 03:45:00 UTC |
| Description | Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter. |
Risk And Classification
Problem Types: CWE-79
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Jenkins Security Advisory 2023-09-20 | MISC | www.jenkins.io | |
| oss-security - Multiple vulnerabilities in Jenkins and Jenkins plugins | MISC | www.openwall.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 691306 Free Berkeley Software Distribution (FreeBSD) Security Update for jenkins (402fccd0-5b6d-11ee-9898-00e081b7aa2d)
- 730932 Jenkins Multiple Security Vulnerabilities (Jenkins Security Advisory 2023-09-20)
- 995337 Java (Maven) Security Update for org.jenkins-ci.main:jenkins-core (GHSA-5j46-5hwq-gwh7)