CVE-2024-28156

Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-site scripting…

Medium · published March 6, 2024

Patch now

High probability of exploitation

CVSS calls it medium at 5.4. It sits in the 99.6th percentile for exploit probability.

CVSS v3.1

5.4

EPSS

79%

Percentile

99.6

In the wild

Unconfirmed

What it is

Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure Build Monitor Views.

The record

Technical detail

CVSS v3.1: 5.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.79250 · 99.6th percentile
Published: 2024-03-06T17:01Z

EPSS history

Timeline

06 MAR 17:01Z
Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-site scripting…
cvelistv5