TI-2025-30299 Aliases CVE-2025-47885 GHSA-xrpq-4g9w-qrwj

Cross-site scripting in Jenkins Health Advisor by CloudBees Plugin

MEDIUM 41CWE-79Published 2025-05-14 · Updated 2025-05-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Jenkins Health Advisor server responses.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00565 47th percentileScored 2026-11-07

Fix Fixed org.jenkins-ci.plugins:cloudbees-jenkins-advisor (Maven): 374.376.v3a_41a_a_142efe

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Jenkins	Jenkins Health Advisor by CloudBees Plugin	up to 374.v194b_d4f0c8c8	—	No fix listed	CNA
—	org.jenkins-ci.plugins:cloudbees-jenkins-advisor (Maven)	before 374.376.v3a_41a_a_142efe	374.376.v3a_41a_a_142efe	Patch available	GHSA-xrpq-4g9w-qrwj

Jenkins Health Advisor by CloudBees Plugin VendorJenkins Affected up to 374.v194b_d4f0c8c8 Fixed in — No fix listed CNA
org.jenkins-ci.plugins:cloudbees-jenkins-advisor (Maven) Vendor— Affected before 374.376.v3a_41a_a_142efe Fixed in 374.376.v3a_41a_a_142efe Patch available GHSA-xrpq-4g9w-qrwj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jenkins:health_advisor_by_cloudbees::::::jenkins::*	up to 374.v194b_d4f0c8c8	Vulnerable	Jenkins

cpe:2.3:a:jenkins:health_advisor_by_cloudbees:*:*:*:*:*:jenkins:*:* Versions up to 374.v194b_d4f0c8c8 Vulnerable ·Jenkins

Remediation

Fix · GHSA-xrpq-4g9w-qrwj org.jenkins-ci.plugins:cloudbees-jenkins-advisor (Maven) Fixed in 374.376.v3a_41a_a_142efe Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-47885
2026-10-03 Alias added: GHSA-xrpq-4g9w-qrwj

References

Advisory 2

Other 2

TI-2020-01970 Cross-site request forgery in Jenkins Health Advisor by CloudBees Plugin CVSS 3.1HIGH 8.8
TI-2020-01971 Missing authorization in Jenkins Health Advisor by CloudBees Plugin CVSS 3.1MEDIUM 4.3
TI-2020-02135 Incorrect authorization in Jenkins Health Advisor by CloudBees Plugin CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences