{"id":"CVE-2023-27905","details":"Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.","aliases":["GHSA-pqg3-xfx2-fmqp"],"modified":"2026-07-15T06:21:48.232439Z","published":"2023-03-10T21:15:15.790Z","references":[{"type":"ADVISORY","url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3063"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jenkins-infra/update-center2","events":[{"introduced":"d9bd8b66cc44895cc8b05fd8dad6692ba9713fe6"},{"last_affected":"27bbed0fe459b6a40568ca420f187945109550db"}],"database_specific":{"cpe":["cpe:2.3:a:jenkins:update-center2:3.13:*:*:*:*:jenkins:*:*","cpe:2.3:a:jenkins:update-center2:3.14:*:*:*:*:jenkins:*:*"],"extracted_events":[{"introduced":"3.13"},{"last_affected":"3.13"},{"introduced":"3.14"},{"last_affected":"3.14"}],"source":"CPE_STRING"}}],"versions":["3.13","3.14","update-center2-3.14","update-center2-3.13"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-27905.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}]}