CVE-2013-0328: Jenkins subject to Cross-site Scripting
Summary
CVE-2013-0328: Jenkins subject to Cross-site Scripting. Affects org.jenkins-ci.main:jenkins-core versions < 1.502. Fixed in 1.502. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. It provides a wide range of features and plugins to support continuous integration and delivery. The vulnerable package in question is 'org.jenkins-ci.main:jenkins-core', which is a core component of Jenkins responsible for its basic functionality.
Vulnerability Detail
The vulnerability identified as CVE-2013-0328 is a Cross-site Scripting (XSS) vulnerability in Jenkins versions before 1.502 and LTS before 1.480.3. This vulnerability allows remote attackers to inject arbitrary web script or HTML into Jenkins through unspecified vectors. The impact of this vulnerability can range from unauthorized access to sensitive information to the execution of malicious code on the victim's browser.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.502
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Jenkins is not immediately feasible, a temporary workaround is to implement input validation and output encoding to prevent the execution of injected scripts. This can be achieved by sanitizing user input and properly encoding output to prevent the interpretation of HTML or JavaScript code.
Conclusion
In conclusion, the Jenkins package 'org.jenkins-ci.main:jenkins-core' is vulnerable to a Cross-site Scripting (XSS) attack. To mitigate this vulnerability, it is recommended to upgrade Jenkins to version 1.502 or later. If immediate upgrade is not possible, implementing input validation and output encoding can serve as a temporary workaround. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Jenkins is an open-source automation server used for continuous integration and delivery of software projects.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability allows remote attackers to inject arbitrary web script or HTML into Jenkins, potentially leading to unauthorized access or execution of malicious code.
To fix this vulnerability, upgrade Jenkins to version 1.502 or later. Alternatively, implement input validation and output encoding to prevent script injection.
Yes, a temporary workaround is to sanitize user input and properly encode output to prevent the execution of injected scripts.
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
