CVE-2024-28156

published 2024-03-06

CVE-2024-28156: Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-site scripting…

Priority P3 42 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure Build Monitor Views.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
jenkins	appspider_plugin	—	—
jenkins	bitbucket_branch_source_plugin	—	—
jenkins	build_monitor_view	<= 1.14-860.vd06ef2568b_3f	—
jenkins	build_monitor_view_plugin	—	—
jenkins	delphix_plugin	—	—
jenkins	gitbucket_plugin	—	—
jenkins	html_publisher_plugin	—	—
jenkins	improper_input_sanitization_in_html_publisher_plugin	—	—
jenkins	mq_notifier_plugin	—	—
jenkins	owasp_dependency-check_plugin	—	—
jenkins	subversion_partial_release_manager_plugin	—	—
jenkins	tls_certificate_validation_in_delphix_plugin	—	—
jenkins_project	jenkins_build_monitor_view_plugin	<= 1.14-860.vd06ef2568b_3f	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79