High severity8.8NVD Advisory· Published May 14, 2025· Updated Jun 17, 2026

CVE-2025-47885

Description

Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Jenkins Health Advisor server responses.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.jenkins-ci.plugins:cloudbees-jenkins-advisorMaven	< 374.376.v3a_41a_a_142efe	374.376.v3a_41a_a_142efe

Affected products

ghsa-coords
pkg:maven/org.jenkins-ci.plugins/cloudbees-jenkins-advisor
Range: < 374.376.v3a_41a_a_142efe
Jenkins Project/Jenkins Health Advisor by CloudBees Plugincpe-rescue
Range: 0
Jenkins Project/Health Advisor By Cloudbees
cpe:2.3:a:jenkins:health_advisor_by_cloudbees:*:*:*:*:*:jenkins:*:*
Range: <=374.v194b_d4f0c8c8

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-xrpq-4g9w-qrwjghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-47885ghsaADVISORY
www.jenkins.io/security/advisory/2025-05-14/nvdVendor AdvisoryWEB
github.com/jenkinsci/cloudbees-jenkins-advisor-plugin/commit/4b456b3110d1504d7dce8e7fca84c4e8793650e6ghsaWEB

News mentions

Jenkins Security Advisory 2025-05-14
Jenkins Security Advisories · May 14, 2025

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000