A stored cross-site scripting vulnerability in Jenkins allows attackers with control over agent processes to execute arbitrary code within the context of the Jenkins master.

The system log viewer fails to properly sanitize log record metadata, including source, level, and timestamp information. An attacker who has compromised or controls an agent process can inject malicious payloads into these fields, which are then executed when a user views the system logs.

This vulnerability carries a CVSS score of 8.8, reflecting its high potential for impact on the integrity and security of the Jenkins environment. Successful exploitation allows an attacker to execute scripts in the browser of a Jenkins administrator, potentially leading to unauthorized configuration changes, credential theft, or further lateral movement within the CI/CD pipeline.

Immediate Action: Upgrade to Jenkins version 2.580 or later, or update to LTS version 2.568.3 or later, to ensure the log viewer properly escapes input metadata.

Proactive Monitoring: Monitor access logs and audit trails for unusual administrative activity or unexpected script execution patterns following log viewing events.

Compensating Controls: Restrict access to the system log viewer to trusted administrative personnel and enforce strict network segmentation between agent nodes and the master controller.

Public Exploit Available: No (exploit_available: false)

The vulnerability represents a significant risk to the security of the build infrastructure. Administrators should prioritize the update to the patched versions of Jenkins immediately to eliminate the risk of stored XSS attacks originating from agent nodes.