CVE-2014-3681: Jenkins Cross-site Scripting vulnerability in org.jenkins-ci.main:jenkins-core
Summary
CVE-2014-3681: Jenkins Cross-site Scripting vulnerability. Affects org.jenkins-ci.main:jenkins-core across 2 version ranges.
< 1.565.3
>= 1.566, < 1.583
Fixed in 1.565.3 or 1.583, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jenkins is an open-source automation server that enables developers to build, test, and deploy their software projects. The org.jenkins-ci.main:jenkins-core package is a fundamental component of Jenkins, providing core functionality for the server. This package is widely used in various software development environments.
Vulnerability Detail
The Jenkins Cross-site Scripting (XSS) vulnerability, identified as CVE-2014-3681, allows remote attackers to inject arbitrary web script or HTML into Jenkins. This vulnerability affects versions before 1.583 and LTS before 1.565.3. The specific vectors through which the attack can be executed are unspecified. However, the consequences of successful exploitation could include unauthorized access, data manipulation, and potential compromise of the Jenkins server.
How To Fix
Latest published version: 2.587 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.565.31.565.3 -
>= 1.566, < 1.5831.583
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround can be implemented by implementing input validation and output encoding in the affected Jenkins instance. This can help mitigate the risk of XSS attacks by sanitizing user input and properly encoding output to prevent script execution. The following code snippet demonstrates an example of input validation and output encoding in Java:
import org.owasp.encoder.Encode;
public class XSSUtils {
public static String sanitizeInput(String input) {
// Implement input validation logic here
return input;
}
public static String encodeOutput(String output) {
// Implement output encoding logic here
return Encode.forHtml(output);
}
}
Conclusion
The Jenkins Cross-site Scripting vulnerability in the org.jenkins-ci.main:jenkins-core package poses a moderate security risk, potentially allowing attackers to inject malicious scripts or HTML into Jenkins. It is crucial to update the package to version 1.583 or later to mitigate this vulnerability. If immediate updating is not possible, implementing input validation and output encoding can serve as a temporary workaround. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.jenkins-ci.main:jenkins-core →
FAQ
Successful exploitation of this vulnerability can lead to arbitrary script or HTML injection, potentially allowing attackers to perform unauthorized actions, manipulate data, or compromise the Jenkins server.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Jenkins instance is affected by this vulnerability. Simply provide the relevant information about your Jenkins setup, and the playground will analyze it for potential vulnerabilities.
Yes, updating the org.jenkins-ci.main:jenkins-core package to version 1.583 or later will address this vulnerability. It is recommended to follow the provided steps in the 'how_to_fix' section to apply the necessary updates.
If updating the package is not immediately feasible, implementing input validation and output encoding in the affected Jenkins instance can serve as a temporary workaround. Refer to the 'workaround' section for more details and example code.
You can find more information about this vulnerability, including its technical details and the affected package versions, in the official GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-cwh9-f8m6-6r63/GHSA-cwh9-f8m6-6r63.json
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.main:jenkins-core.
