VYPR
← All advisories
Moderate severityNVD Advisory· Published Oct 16, 2015· Updated May 6, 2026

CVE-2015-1812

CVE-2015-1812

Description

Cross-site scripting (XSS) vulnerability in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-1813.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.jenkins-ci.main:jenkins-coreMaven
< 1.596.21.596.2
org.jenkins-ci.main:jenkins-coreMaven
>= 1.600, < 1.6061.606

Affected products

3
  • Jenkins Project/Jenkins2 versions
    cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*range: <=1.605
    • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*range: <=1.596.1
  • Red Hat/Openshift
    cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:*
    Range: <=3.1

Patches

3
f58ba6e72f97

Merge pull request #15 from jenkinsci-cert/SECURITY-171

https://github.com/jenkinsci/jenkinsKohsuke KawaguchiMar 16, 2015via ghsa
commit
2 files changed · +10 −1
  • core/src/main/java/hudson/util/FormValidation.java+1 −1 modified
    @@ -196,7 +196,7 @@ private static FormValidation _error(Kind kind, Throwable e, String message) {
             " <a href='#' class='showDetails'>"
             + Messages.FormValidation_Error_Details()
             + "</a><pre style='display:none'>"
-            + Functions.printThrowable(e) +
+            + Util.escape(Functions.printThrowable(e)) +
             "</pre>",kind
         );
     }
  • core/src/test/java/hudson/util/FormValidationTest.java+9 −0 modified
    @@ -23,6 +23,10 @@
  */
 package hudson.util;
 
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.CoreMatchers.not;
+import static org.hamcrest.MatcherAssert.assertThat;
+
 import junit.framework.TestCase;
 
 /**
@@ -51,4 +55,9 @@ public void testValidateRequired_Empty() {
     public void testMessage() {
         assertEquals("test msg", FormValidation.errorWithMarkup("test msg").getMessage());
     }
+
+    public void testFormValidationException() {
+        FormValidation fv = FormValidation.error(new Exception("<html"), "Message<html");
+        assertThat(fv.renderHtml(), not(containsString("<html")));
+    }
 }
f880d8d2cd9d

[SECURITY-171] test

https://github.com/jenkinsci/jenkinsOliver GondžaMar 7, 2015via ghsa
commit
1 file changed · +9 −0
  • core/src/test/java/hudson/util/FormValidationTest.java+9 −0 modified
    @@ -23,6 +23,10 @@
  */
 package hudson.util;
 
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.CoreMatchers.not;
+import static org.hamcrest.MatcherAssert.assertThat;
+
 import junit.framework.TestCase;
 
 /**
@@ -51,4 +55,9 @@ public void testValidateRequired_Empty() {
     public void testMessage() {
         assertEquals("test msg", FormValidation.errorWithMarkup("test msg").getMessage());
     }
+
+    public void testFormValidationException() {
+        FormValidation fv = FormValidation.error(new Exception("<html"), "Message<html");
+        assertThat(fv.renderHtml(), not(containsString("<html")));
+    }
 }
feb2703adb0c

[FIXED SECURITY-171]

https://github.com/jenkinsci/jenkinsKohsuke KawaguchiMar 7, 2015via ghsa
commit
1 file changed · +1 −1
  • core/src/main/java/hudson/util/FormValidation.java+1 −1 modified
    @@ -196,7 +196,7 @@ private static FormValidation _error(Kind kind, Throwable e, String message) {
             " <a href='#' class='showDetails'>"
             + Messages.FormValidation_Error_Details()
             + "</a><pre style='display:none'>"
-            + Functions.printThrowable(e) +
+            + Util.escape(Functions.printThrowable(e)) +
             "</pre>",kind
         );
     }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.