Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote authenticated users with write permission to inject arbitrary web script or HTML via unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise
    1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote authenticated users with write
    permission to inject arbitrary web script or HTML via unspecified vectors. (CVE-2013-2033)

The remote web server hosts a version of Jenkins or Jenkins Enterprise that is affected by multiple vulnerabilities :

  - The included component 'ZeroClipboard' contains an     error in the file 'ZeroClipboard10.swf' that could     allow cross-site scripting attacks.
    (CVE-2013-1808)

  - An unspecified cross-site scripting error exists.
    (CVE-2013-2033)

  - Multiple errors exist that could lead to cross-site     request forgery attacks, thus allowing an attacker to     trick an administrator into executing arbitrary code.
    (CVE-2013-2034)

Jenkins Security Advisory reports :

This advisory announces multiple security vulnerabilities that were found in Jenkins core.

- SECURITY-63 / CVE-2013-2034

This creates a cross-site request forgery (CSRF) vulnerability on Jenkins master, where an anonymous attacker can trick an administrator to execute arbitrary code on Jenkins master by having him open a specifically crafted attack URL.

There's also a related vulnerability where the permission check on this ability is done imprecisely, which may affect those who are running Jenkins instances with a custom authorization strategy plugin.

- SECURITY-67 / CVE-2013-2033

This creates a cross-site scripting (XSS) vulnerability, where an attacker with a valid user account on Jenkins can execute JavaScript in the browser of other users, if those users are using certain browsers.

- SECURITY-69 / CVE-2013-2034

This is another CSRF vulnerability that allows an attacker to cause a deployment of binaries to Maven repositories. This vulnerability has the same CVE ID as SEUCRITY-63.

- SECURITY-71 / CVE-2013-1808

This creates a cross-site scripting (XSS) vulnerability.

ID	Name	Product	Family	Severity
412353	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-826f-32qm-vm3j)	Tenable Cloud Security	SCA Checks	low
412353	SCA: security update for org.jenkins-ci.main:jenkins-core (GHSA-826f-32qm-vm3j)	Tenable Self-Hosted Container Security	SCA Checks	low
66898	Jenkins < 1.514 / 1.509.1 and Jenkins Enterprise 1.466.x / 1.480.x < 1.466.14.1 / 1.480.4.1 Multiple Vulnerabilities	Nessus	CGI abuses	medium
66311	FreeBSD : jenkins -- multiple vulnerabilities (622e14b1-b40c-11e2-8441-00e0814cab4e)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2013-2033

low

Tenable Plugins

low

low

medium

medium