CVE-2012-0324: Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins E...

Security readout for executives and security teams

This is an old Jenkins cross-site scripting issue. A remote attacker could cause vulnerable Jenkins pages to run attacker-controlled script or HTML. For executives, the main concern is unauthorized actions or data exposure through users’ Jenkins sessions, especially where legacy Jenkins instances remain internet-accessible. Exposure is most likely in legacy Jenkins or Jenkins Enterprise installations that were not upgraded after the March 2012 advisory. Current, maintained Jenkins deployments are unlikely to be affected unless they are frozen on the listed vulnerable branches. Treat this as a legacy exposure check. It should not displace urgent actively exploited issues, but any vulnerable Jenkins instance should be upgraded because Jenkins often holds build secrets, credentials, and release authority. Mitigation focus: Upgrade Jenkins to 1.454 or later, or LTS to 1.424.5 or later.; Upgrade Jenkins Enterprise beyond the fixed 1.400.x and 1.424.x releases.; Check the CloudBees/Jenkins advisory for product-specific upgrade guidance..

Prepared

Jun 24, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.