CVE-2023-46650 Stored XSS vulnerability in Jenkins GitHub Plugin

What is CVE-2023-46650?

CVE-2023-46650 is a medium-severity cross-site scripting vulnerability in Jenkins GitHub Plugin, published on 25 Oct 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Weakness: CWE-79

Which versions are affected by CVE-2023-46650?

2 open source packages ship an affected version, including com.coravy.hudson.plugins.github:github. It affects 1 product.

Products include Jenkins Github.

How do I fix CVE-2023-46650?

Upgrade com.coravy.hudson.plugins.github:github to 1.37.3.1 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-46650 being exploited?

There is no known exploitation of CVE-2023-46650 in the wild and no public exploit code.

Other vulnerabilities in Jenkins GitHub Plugin

• CVE-2026-42523 Jenkins GitHub Plugin has an XSS vulnerability Critical 9.0
• CVE-2018-1000600 CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials High 8.8
• CVE-2018-1000183 Jenkins GitHub Plugin exposure of sensitive information vulnerability exists Medium 6.5
• CVE-2018-1000184 Jenkins GitHub Plugin server-side request forgery vulnerability exists Medium 5.4
• CVE-2022-36885 Jenkins GitHub plugin uses weak webhook signature function Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mv77-fj63-q5w8.