CVE-2023-27905: Cross site scripting vulnerability in update-center2

CVE-2023-27905 PUBLISHED CVSS 5.400000095367432 MEDIUM

Cross site scripting vulnerability in update-center2

Reported by jenkins · Published March 8, 2023

Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.

Risk scores

CVSS 3.1

5.400000095367432

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

Vendor	Product	Versions
Jenkins Project	Jenkins update-center2	3.13, 3.14
Jenkins Project	Jenkins update-center2	3.13, 3.14
Maven	org.jenkins-ci:update-center2	3.13

Timeline

Mar 8, 2023 CVE Published
Mar 9, 2023 EPSS Score (30 in total, the first dated here)
Mar 9, 2023 PoC Published (8 in total, the first dated here)
Mar 17, 2026 Security Advisory (9 in total, the first dated here)
Mar 21, 2026 Distribution Patch (8 in total, the first dated here)
Jun 17, 2026 CVE Updated

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2023-27905
vulnetix vdb fixes CVE-2023-27905

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-27905/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Jenkins Security Advisory 2023-03-08 vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-27905 advisory
https://github.com/advisories/GHSA-pqg3-xfx2-fmqp advisory

Look up in the Resolve Platform →