CVE-2023-27905: Jenkins Update-CENTER2

Critical severity, CVSS 9.6. EPSS: 1.5% chance of exploitation in the next 30 days.

Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.

Affected products

• Jenkins Update-CENTER2: version 3.13 only; version 3.14 only

Published 2023-03-10. Last modified 2026-06-17.