CVE-2011-4344

Cross-site scripting (XSS) vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.

• CWE-79

• http://groups.google.com/group/jenkinsci-advisories/msg/1b94588f90f876b5?dmode=source&output=gplain
• http://openwall.com/lists/oss-security/2011/11/23/5Patch
• http://openwall.com/lists/oss-security/2011/11/23/6Patch
• http://secunia.com/advisories/46911
• http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2011-11-08.cbPatch, Vendor Advisory
• http://www.securityfocus.com/bid/50786
• https://github.com/jenkinsci/winstone/commit/410ed3001d51c689cf59085b7417466caa2ded7b.patchPatch
• http://groups.google.com/group/jenkinsci-advisories/msg/1b94588f90f876b5?dmode=source&output=gplain
• http://openwall.com/lists/oss-security/2011/11/23/5Patch
• http://openwall.com/lists/oss-security/2011/11/23/6Patch
• http://secunia.com/advisories/46911
• http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2011-11-08.cbPatch, Vendor Advisory
• http://www.securityfocus.com/bid/50786
• https://github.com/jenkinsci/winstone/commit/410ed3001d51c689cf59085b7417466caa2ded7b.patchPatch

Published

Dec 1, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-4338Shaman 1.0.9: Users can add the line askforpwd=false to his …7.8
• CVE-2011-4339ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in …
• CVE-2011-4340Multiple cross-site scripting (XSS) vulnerabilities in Symph…
• CVE-2011-4341Multiple SQL injection vulnerabilities in symphony/content/c…
• CVE-2011-4342PHP remote file inclusion vulnerability in wp_xml_export.php…
• CVE-2011-4343Information disclosure vulnerability in Apache MyFaces Core …
• CVE-2011-4345Cross-site scripting (XSS) vulnerability in Namazu before 2.…
• CVE-2011-4346Cross-site scripting (XSS) vulnerability in the web interfac…
• CVE-2011-4347The kvm_vm_ioctl_assign_device function in virt/kvm/assigned…
• CVE-2011-4348Race condition in the sctp_rcv function in net/sctp/input.c …
• CVE-2011-4349Multiple SQL injection vulnerabilities in (1) cd-mapping-db.…
• CVE-2011-4350Yaws 1.91 has a directory traversal vulnerability in the way…6.5