CVE-2023-40350

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Jenkins Docker Swarm Plugin 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboard view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control responses from Docker.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Jenkins Project	Jenkins Docker Swarm Plugin	<= 1.11

References

http://www.openwall.com/lists/oss-security/2023/08/16/3Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2811Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/08/16/3Mailing List, Third Party Advisory
https://www.jenkins.io/security/advisory/2023-08-16/#SECURITY-2811Vendor Advisory

Timeline

Published: Aug 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-403514.3A cross-site request forgery (CSRF) vulnerability in Jenkins Favorite View Plugin 5.v77a_37f62782d and earlier allows attackers to add or re CVE-2023-403527.2McAfee Safe Connect before 2.16.1.126 may allow an adversary with system privileges to achieve privilege escalation by loading arbitrary DLL CVE-2023-403533.3An issue was discovered in Exynos Mobile Processor 980 and 2100. An integer overflow at a buffer index can prevent the execution of requeste CVE-2023-403546.5An issue was discovered in MariaDB MaxScale before 23.02.3. A user enters an encrypted password on a "maxctrl create service" command line, CVE-2023-403555.4Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allo CVE-2023-403568.7PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this CVE-2023-403578.0Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are a CVE-2023-403599.8xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor un CVE-2023-40364.3The Simple Blog Card WordPress plugin before 1.32 does not ensure that posts to be displayed via a shortcode are public, allowing any authen CVE-2023-403605.5QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whether an endurance gr CVE-2023-403617.8SECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. To exploit this, an attacker needs access as a lo CVE-2023-403624.3An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protections allows remote att