{"schemaVersion":3,"id":"CVE-2012-0324","aliases":["GHSA-4w4h-8qh9-342x"],"status":"published","duplicateOf":null,"title":null,"description":"Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0325.","dates":{"published":"2012-03-09T11:00:00.000Z","modified":"2024-08-06T18:23:30.582Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.3,"severity":"medium","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Maven","score":2.3,"severity":"low","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","exploitability":null,"impact":null,"computed":true}]},"epss":{"probability":0.01124,"percentile":0.65767,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.01124},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01124,"percentile":0.65767}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01124,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01124,"percentile":0.65767}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"cloudbees","product":"jenkins","name":"jenkins","label":"jenkins","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.400","noFixRecorded":false,"fixedIn":null},{"text":"1.400.0.12","noFixRecorded":false,"fixedIn":null},{"text":"1.424","noFixRecorded":false,"fixedIn":null},{"text":"1.424.5","noFixRecorded":false,"fixedIn":null},{"text":"≤ 1.453","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.400 | 1.400.0.12 | 1.424 | 1.424.5 | ≤ 1.453","eol":null,"hubHref":"/vendor/cloudbees/jenkins"},{"vendor":"jenkins","product":"jenkins","name":"Jenkins","label":"jenkins","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.301","noFixRecorded":false,"fixedIn":null},{"text":"1.302","noFixRecorded":false,"fixedIn":null},{"text":"1.303","noFixRecorded":false,"fixedIn":null},{"text":"1.304","noFixRecorded":false,"fixedIn":null},{"text":"1.305","noFixRecorded":false,"fixedIn":null},{"text":"1.306","noFixRecorded":false,"fixedIn":null},{"text":"1.307","noFixRecorded":false,"fixedIn":null},{"text":"1.308","noFixRecorded":false,"fixedIn":null},{"text":"1.309","noFixRecorded":false,"fixedIn":null},{"text":"1.310","noFixRecorded":false,"fixedIn":null},{"text":"1.311","noFixRecorded":false,"fixedIn":null},{"text":"1.312","noFixRecorded":false,"fixedIn":null},{"text":"1.313","noFixRecorded":false,"fixedIn":null},{"text":"1.314","noFixRecorded":false,"fixedIn":null},{"text":"1.315","noFixRecorded":false,"fixedIn":null},{"text":"1.316","noFixRecorded":false,"fixedIn":null},{"text":"1.317","noFixRecorded":false,"fixedIn":null},{"text":"1.318","noFixRecorded":false,"fixedIn":null},{"text":"1.319","noFixRecorded":false,"fixedIn":null},{"text":"1.320","noFixRecorded":false,"fixedIn":null},{"text":"1.321","noFixRecorded":false,"fixedIn":null},{"text":"1.322","noFixRecorded":false,"fixedIn":null},{"text":"1.323","noFixRecorded":false,"fixedIn":null},{"text":"1.324","noFixRecorded":false,"fixedIn":null},{"text":"1.325","noFixRecorded":false,"fixedIn":null},{"text":"1.326","noFixRecorded":false,"fixedIn":null},{"text":"1.327","noFixRecorded":false,"fixedIn":null},{"text":"1.328","noFixRecorded":false,"fixedIn":null},{"text":"1.329","noFixRecorded":false,"fixedIn":null},{"text":"1.330","noFixRecorded":false,"fixedIn":null},{"text":"1.331","noFixRecorded":false,"fixedIn":null},{"text":"1.332","noFixRecorded":false,"fixedIn":null},{"text":"1.333","noFixRecorded":false,"fixedIn":null},{"text":"1.334","noFixRecorded":false,"fixedIn":null},{"text":"1.335","noFixRecorded":false,"fixedIn":null},{"text":"1.336","noFixRecorded":false,"fixedIn":null},{"text":"1.337","noFixRecorded":false,"fixedIn":null},{"text":"1.338","noFixRecorded":false,"fixedIn":null},{"text":"1.339","noFixRecorded":false,"fixedIn":null},{"text":"1.340","noFixRecorded":false,"fixedIn":null},{"text":"1.341","noFixRecorded":false,"fixedIn":null},{"text":"1.342","noFixRecorded":false,"fixedIn":null},{"text":"1.343","noFixRecorded":false,"fixedIn":null},{"text":"1.344","noFixRecorded":false,"fixedIn":null},{"text":"1.345","noFixRecorded":false,"fixedIn":null},{"text":"1.346","noFixRecorded":false,"fixedIn":null},{"text":"1.347","noFixRecorded":false,"fixedIn":null},{"text":"1.348","noFixRecorded":false,"fixedIn":null},{"text":"1.349","noFixRecorded":false,"fixedIn":null},{"text":"1.350","noFixRecorded":false,"fixedIn":null},{"text":"1.351","noFixRecorded":false,"fixedIn":null},{"text":"1.352","noFixRecorded":false,"fixedIn":null},{"text":"1.353","noFixRecorded":false,"fixedIn":null},{"text":"1.354","noFixRecorded":false,"fixedIn":null},{"text":"1.355","noFixRecorded":false,"fixedIn":null},{"text":"1.356","noFixRecorded":false,"fixedIn":null},{"text":"1.357","noFixRecorded":false,"fixedIn":null},{"text":"1.358","noFixRecorded":false,"fixedIn":null},{"text":"1.359","noFixRecorded":false,"fixedIn":null},{"text":"1.360","noFixRecorded":false,"fixedIn":null},{"text":"1.361","noFixRecorded":false,"fixedIn":null},{"text":"1.362","noFixRecorded":false,"fixedIn":null},{"text":"1.363","noFixRecorded":false,"fixedIn":null},{"text":"1.364","noFixRecorded":false,"fixedIn":null},{"text":"1.365","noFixRecorded":false,"fixedIn":null},{"text":"1.366","noFixRecorded":false,"fixedIn":null},{"text":"1.367","noFixRecorded":false,"fixedIn":null},{"text":"1.368","noFixRecorded":false,"fixedIn":null},{"text":"1.369","noFixRecorded":false,"fixedIn":null},{"text":"1.370","noFixRecorded":false,"fixedIn":null},{"text":"1.371","noFixRecorded":false,"fixedIn":null},{"text":"1.372","noFixRecorded":false,"fixedIn":null},{"text":"1.373","noFixRecorded":false,"fixedIn":null},{"text":"1.374","noFixRecorded":false,"fixedIn":null},{"text":"1.375","noFixRecorded":false,"fixedIn":null},{"text":"1.376","noFixRecorded":false,"fixedIn":null},{"text":"1.377","noFixRecorded":false,"fixedIn":null},{"text":"1.378","noFixRecorded":false,"fixedIn":null},{"text":"1.379","noFixRecorded":false,"fixedIn":null},{"text":"1.380","noFixRecorded":false,"fixedIn":null},{"text":"1.382","noFixRecorded":false,"fixedIn":null},{"text":"1.383","noFixRecorded":false,"fixedIn":null},{"text":"1.384","noFixRecorded":false,"fixedIn":null},{"text":"1.386","noFixRecorded":false,"fixedIn":null},{"text":"1.387","noFixRecorded":false,"fixedIn":null},{"text":"1.388","noFixRecorded":false,"fixedIn":null},{"text":"1.389","noFixRecorded":false,"fixedIn":null},{"text":"1.390","noFixRecorded":false,"fixedIn":null},{"text":"1.391","noFixRecorded":false,"fixedIn":null},{"text":"1.392","noFixRecorded":false,"fixedIn":null},{"text":"1.393","noFixRecorded":false,"fixedIn":null},{"text":"1.394","noFixRecorded":false,"fixedIn":null},{"text":"1.395","noFixRecorded":false,"fixedIn":null},{"text":"1.396","noFixRecorded":false,"fixedIn":null},{"text":"1.397","noFixRecorded":false,"fixedIn":null},{"text":"1.398","noFixRecorded":false,"fixedIn":null},{"text":"1.399","noFixRecorded":false,"fixedIn":null},{"text":"1.400","noFixRecorded":false,"fixedIn":null},{"text":"1.401","noFixRecorded":false,"fixedIn":null},{"text":"1.402","noFixRecorded":false,"fixedIn":null},{"text":"1.403","noFixRecorded":false,"fixedIn":null},{"text":"1.404","noFixRecorded":false,"fixedIn":null},{"text":"1.405","noFixRecorded":false,"fixedIn":null},{"text":"1.406","noFixRecorded":false,"fixedIn":null},{"text":"1.407","noFixRecorded":false,"fixedIn":null},{"text":"1.408","noFixRecorded":false,"fixedIn":null},{"text":"1.409","noFixRecorded":false,"fixedIn":null},{"text":"1.409.1","noFixRecorded":false,"fixedIn":null},{"text":"1.409.2","noFixRecorded":false,"fixedIn":null},{"text":"1.410","noFixRecorded":false,"fixedIn":null},{"text":"1.411","noFixRecorded":false,"fixedIn":null},{"text":"1.412","noFixRecorded":false,"fixedIn":null},{"text":"1.413","noFixRecorded":false,"fixedIn":null},{"text":"1.414","noFixRecorded":false,"fixedIn":null},{"text":"1.415","noFixRecorded":false,"fixedIn":null},{"text":"1.416","noFixRecorded":false,"fixedIn":null},{"text":"1.417","noFixRecorded":false,"fixedIn":null},{"text":"1.418","noFixRecorded":false,"fixedIn":null},{"text":"1.419","noFixRecorded":false,"fixedIn":null},{"text":"1.420","noFixRecorded":false,"fixedIn":null},{"text":"1.421","noFixRecorded":false,"fixedIn":null},{"text":"1.422","noFixRecorded":false,"fixedIn":null},{"text":"1.423","noFixRecorded":false,"fixedIn":null},{"text":"1.424","noFixRecorded":false,"fixedIn":null},{"text":"1.425","noFixRecorded":false,"fixedIn":null},{"text":"1.426","noFixRecorded":false,"fixedIn":null},{"text":"1.427","noFixRecorded":false,"fixedIn":null},{"text":"1.428","noFixRecorded":false,"fixedIn":null},{"text":"1.429","noFixRecorded":false,"fixedIn":null},{"text":"1.430","noFixRecorded":false,"fixedIn":null},{"text":"1.431","noFixRecorded":false,"fixedIn":null},{"text":"1.432","noFixRecorded":false,"fixedIn":null},{"text":"1.433","noFixRecorded":false,"fixedIn":null},{"text":"1.434","noFixRecorded":false,"fixedIn":null},{"text":"1.435","noFixRecorded":false,"fixedIn":null},{"text":"1.436","noFixRecorded":false,"fixedIn":null},{"text":"1.437","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.301 | 1.302 | 1.303 | 1.304 | 1.305 | 1.306 | 1.307 | 1.308 | 1.309 | 1.310 | 1.311 | 1.312 | 1.313 | 1.314 | 1.315 | 1.316 | 1.317 | 1.318 | 1.319 | 1.320 | 1.321 | 1.322 | 1.323 | 1.324 | 1.325 | 1.326 | 1.327 | 1.328 | 1.329 | 1.330 | 1.331 | 1.332 | 1.333 | 1.334 | 1.335 | 1.336 | 1.337 | 1.338 | 1.339 | 1.340 | 1.341 | 1.342 | 1.343 | 1.344 | 1.345 | 1.346 | 1.347 | 1.348 | 1.349 | 1.350 | 1.351 | 1.352 | 1.353 | 1.354 | 1.355 | 1.356 | 1.357 | 1.358 | 1.359 | 1.360 | 1.361 | 1.362 | 1.363 | 1.364 | 1.365 | 1.366 | 1.367 | 1.368 | 1.369 | 1.370 | 1.371 | 1.372 | 1.373 | 1.374 | 1.375 | 1.376 | 1.377 | 1.378 | 1.379 | 1.380 | 1.382 | 1.383 | 1.384 | 1.386 | 1.387 | 1.388 | 1.389 | 1.390 | 1.391 | 1.392 | 1.393 | 1.394 | 1.395 | 1.396 | 1.397 | 1.398 | 1.399 | 1.400 | 1.401 | 1.402 | 1.403 | 1.404 | 1.405 | 1.406 | 1.407 | 1.408 | 1.409 | 1.409.1 | 1.409.2 | 1.410 | 1.411 | 1.412 | 1.413 | 1.414 | 1.415 | 1.416 | 1.417 | 1.418 | 1.419 | 1.420 | 1.421 | 1.422 | 1.423 | 1.424 | 1.425 | 1.426 | 1.427 | 1.428 | 1.429 | 1.430 | 1.431 | 1.432 | 1.433 | 1.434 | 1.435 | 1.436 | 1.437","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"jenkins","label":"Jenkins","category":"server-app"}},"hubHref":"/vendor/jenkins/jenkins"},{"vendor":"org.jenkins-ci.main","product":"jenkins-core","name":"org.jenkins-ci.main:jenkins-core","label":"jenkins-core","ecosystem":"Maven","cpePart":null,"purl":"pkg:maven/org.jenkins-ci.main/jenkins-core","purlType":"maven","versions":[{"text":"≥ 1.425, < 1.454","noFixRecorded":false,"fixedIn":null},{"text":"< 1.424.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.425, < 1.454 | < 1.424.5","eol":null,"hubHref":null}],"affectedCount":3,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2012-000022","label":"jvndb.jvn.jp/jvndb/JVNDB-2012-000022","hostname":"jvndb.jvn.jp","tags":["Third Party Advisory","X Refsource JVNDB","WEB"]},{"url":"http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-03-05.cb","label":"www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-03-05.cb","hostname":"www.cloudbees.com","tags":["X Refsource CONFIRM","Vendor Advisory","WEB"]},{"url":"http://www.securityfocus.com/bid/52384","label":"www.securityfocus.com/bid/52384","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://jvn.jp/en/jp/JVN14791558/index.html","label":"jvn.jp/en/jp/JVN14791558/index.html","hostname":"jvn.jp","tags":["Third Party Advisory","X Refsource JVN","WEB"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0324","label":"nvd.nist.gov/vuln/detail/CVE-2012-0324","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/jenkinsci/jenkins","label":"github.com/jenkinsci/jenkins","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://web.archive.org/web/20200229025003/https://www.securityfocus.com/bid/52384","label":"web.archive.org/web/20200229025003/https://www.securityfocus.com/bid/52384","hostname":"web.archive.org","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2012-03-09T11:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-06T18:23:30.582Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":17,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T03:25:40.531Z","stale":false,"partial":false}}