CVE-2025-47885: Jenkins Health Advisor by CloudBees Plugin Vulnerable to Cross-Site Scripting

May 14, 2025 (updated May 16, 2025)

Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Jenkins Health Advisor server responses.

References

github.com/advisories/GHSA-xrpq-4g9w-qrwj
github.com/jenkinsci/cloudbees-jenkins-advisor-plugin
github.com/jenkinsci/cloudbees-jenkins-advisor-plugin/commit/4b456b3110d1504d7dce8e7fca84c4e8793650e6
nvd.nist.gov/vuln/detail/CVE-2025-47885
www.jenkins.io/security/advisory/2025-05-14/

Code Behaviors & Features

Detect and mitigate CVE-2025-47885 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →