CVSS 3.0
4.7 mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2017-17383
Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form, as demonstrated by the JDK tool in Jenkins core and the Ant tool in the Ant plugin, aka SECURITY-624.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jenkins:jenkins
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-x3rc-cxv7-6xp6 | Maven | org.jenkins-ci.main:jenkins-core | <2.94 | 2.94 |