Jenkins versions 2.483 through 2.567 and LTS 2.492.1 through 2.555.2 fail to escape the user‑provided description supplied via the POST config.xml API. This oversight allows a stored cross‑site scripting vulnerability that can be triggered by any user possessing Agent/Configure permission, enabling a malicious actor to inject and execute arbitrary scripts within the context of Jenkins.

Jenkins by the Jenkins Project. The affected releases include Jenkins core versions 2.483 through 2.567 and the long‑term support releases 2.492.1 through 2.555.2.

The CVSS score is 5.4 and the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, so absolute exploitation probability is unknown. However, the requirement of Agent/Configure permission indicates that the attack surface is limited to users who can configure agents, meaning an attacker must first gain an internal role or compromise an account with that permission. If the permission is granted widely, the risk becomes higher. The disclosed nature of the issue as a stored cross‑site scripting flaw suggests that successful exploitation could lead to malicious script execution in the victim’s browser, potentially exposing Jenkins session cookies, accessing internal services, or defacing the interface.