CVE-2023-40350

MediumCVSS 5.4

Published: 16/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

39th percentile - higher than 39% of all known CVEs

Summary

Jenkins Docker Swarm Plugin version 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboard view, leading to a stored XSS vulnerability.

Risk Assessment

An attacker able to control responses from Docker can exploit this vulnerability to execute malicious code in the user's browser context, potentially leading to data theft or session hijacking.

Recommendation

It is recommended to update the Jenkins Docker Swarm Plugin to the latest version to mitigate this vulnerability and implement additional security measures such as input validation and sanitization.

Original NVD description (English source)

Jenkins Docker Swarm Plugin 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboard view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control responses from Docker.