CVE-2024-28157

Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.

Affected

Jenkins Project · Jenkins GitBucket Plugin

CVSS v3.1 CNA

8.0 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

1.25% chance of exploitation in the next 30 days, 69th percentile

Published

2024-03-06

Updated

2025-02-13

Proof-of-concept exploits (2)

• shinigami-777/PoC_CVE-2024-281570★ · 2025-10-05
• Jayesh-Dev21/PoC_CVE-2024-281570★ · 2026-09-18

Security advisories

• https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3249
• http://www.openwall.com/lists/oss-security/2024/03/06/3
• advisories/GHSA-5j74-g3c5-wqww

References

• CVE Record
• NVD entry

Related

• CVE-2025-11579
• CVE-2025-2568
• CVE-2025-54887