CVE-2013-5573: Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote att...

Security readout for executives and security teams

Jenkins 1.523 allowed attacker-controlled content in a user's Description field to be treated as web script or HTML. In practical terms, someone able to reach the user configuration path could plant content that runs in another user's browser when viewed. This is mainly a Jenkins administrative/user-management risk, not evidence of host-level code execution. Exposure is most likely where Jenkins 1.523 is still running and user profile/configuration pages are reachable by untrusted or lower-privileged users. Internet-facing Jenkins instances or shared CI environments increase concern. The supplied data does not identify other affected versions. Prioritize remediation if Jenkins 1.523 supports production build or deployment pipelines, especially if exposed beyond trusted administrators. If no Jenkins 1.523 exists, record the finding as not applicable. Because no active exploitation is evidenced, this is urgent for exposed legacy systems but not a broad emergency. Mitigation focus: Identify and retire any Jenkins 1.523 instances.; Check Jenkins vendor guidance for the corrected upgrade path.; Restrict Jenkins access to trusted users and networks..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.