CVE-2013-2033: Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466....

Security readout for executives and security teams

This CVE is an authenticated stored or reflected XSS risk in older Jenkins and CloudBees Enterprise Jenkins releases. A user who can log in and has write permission could inject script or HTML through unspecified vectors. Business urgency depends on whether legacy Jenkins versions remain in use and how broadly write access is granted. Exposure is most likely in legacy Jenkins or CloudBees Enterprise Jenkins deployments that have not been upgraded past the listed fixed versions. Risk increases where many users, contractors, or automation identities have write permission in Jenkins projects or configuration areas. Treat this as a legacy CI hygiene issue with moderate priority. It is not reported as actively exploited here, but Jenkins often has sensitive build, credential, and release access, so outdated instances with broad write access should be remediated promptly. Mitigation focus: Upgrade Jenkins and Enterprise Jenkins beyond the affected version ranges named in the advisory.; Review CloudBees or Jenkins vendor guidance before making production changes.; Restrict Jenkins write permissions to trusted users and required automation identities..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.