Jenkins versions 2.483 through 2.550 and LTS versions 2.492.1 through 2.541.1 are vulnerable to stored cross-site scripting, which could allow authenticated attackers with specific agent permissions to execute malicious scripts.

This is a stored cross-site scripting (XSS) flaw caused by the failure to sanitize user-provided descriptions in the Mark temporarily offline feature. The vulnerability is exploitable by any user possessing Agent/Configure or Agent/Disconnect permissions.

Successful exploitation allows an attacker to inject malicious scripts that execute within the context of an administrator or other user session. This could lead to unauthorized actions performed on behalf of the victim, session hijacking, or the modification of Jenkins configuration, resulting in significant security compromise and potential loss of data integrity. Given the CVSS score of 8.0, this represents a high-severity risk to development and deployment pipelines.

Immediate Action: Update to Jenkins 2.551 or LTS 2.541.2 to apply the necessary security patches.

Proactive Monitoring: Review Jenkins access logs for unusual activity involving the Mark temporarily offline feature or unexpected configuration changes by users with agent permissions.

Compensating Controls: Restrict Agent/Configure and Agent/Disconnect permissions to only the most trusted users within the organization to minimize the attack surface.

Public Exploit Available: Unknown.

The presence of a stored XSS vulnerability in a CI/CD platform like Jenkins poses a substantial risk to the software supply chain. Administrators should prioritize upgrading to the fixed versions immediately to remediate the flaw. Until the patch is applied, strictly enforce the principle of least privilege regarding agent configuration permissions to limit potential exposure.