CVE-2024-28156

What it actually does

Jenkins Build Monitor View Plugin versions 1.14-860.vd06ef2568b_3f and earlier fail to HTML-escape Build Monitor View names before rendering them in Jenkins pages. A user who can configure Build Monitor Views can save JavaScript or HTML in a view name, causing that script to execute later in the browser of any user who opens the affected Jenkins page. Because the script runs in the Jenkins web origin, it can act with the victim user's Jenkins session privileges, read UI-accessible data, issue authenticated requests, retrieve CSRF crumbs, modify jobs or views if the victim has permission, and potentially help pivot toward credential exposure or build pipeline manipulation.

Why it matters to the business

Successful exploitation can turn a seemingly low-privileged Jenkins configuration capability into compromise of administrators or developers who view the affected page. This can disrupt CI/CD operations, expose sensitive build metadata or secrets visible through the Jenkins UI, alter jobs or pipelines, and create a path to tamper with software delivery workflows. The EPSS score is high, indicating elevated likelihood of exploitation attempts in the wild despite no CISA KEV listing and no known ransomware association in the provided data.

How an attack unfolds

An attacker first obtains or already has Jenkins permissions sufficient to create or configure Build Monitor Views. They rename or create a Build Monitor View with a malicious HTML/JavaScript payload instead of a normal display name. The plugin stores that name and later renders it without proper escaping. When another Jenkins user, especially an administrator or release engineer, opens the Build Monitor View or a page that lists it, the payload executes in that user's browser under the Jenkins origin. The attacker-controlled script can then make authenticated Jenkins requests as the victim, collect information visible to that user, modify view or job configuration when permitted, trigger builds, or stage additional persistence through Jenkins configuration changes. Exploitation requires the ability to configure Build Monitor Views and user interaction by a victim who visits the poisoned view or listing page.

How to fix it

Upgrade the Jenkins Build Monitor View Plugin to a version newer than 1.14-860.vd06ef2568b_3f that contains the escaping fix, using Jenkins Plugin Manager or the Jenkins update center. If no fixed package version is available in the local update source, temporarily disable or uninstall the plugin until a fixed release can be installed. Restrict Build Monitor View creation and configuration to trusted administrators only, review all existing Build Monitor View names, and rename any view containing markup, script, event handlers, or suspicious encoded characters. If exploitation is suspected, rotate Jenkins API tokens and credentials that may have been exposed through the UI, review recent job and global configuration changes, and invalidate active sessions where practical.

How to confirm the fix worked

Confirm the installed Build Monitor View Plugin version is newer than 1.14-860.vd06ef2568b_3f through Jenkins Plugin Manager, Jenkins CLI, or the plugin inventory on disk. Verify no Build Monitor View names contain HTML tags, JavaScript URLs, event-handler attributes, or encoded script content. Inspect Jenkins configuration XML files for suspicious view name values and confirm names render as inert text rather than executable markup after upgrade. Where safe, validate in a non-production test Jenkins instance by creating a view name containing harmless markup-like text and confirming it is displayed escaped, not interpreted by the browser. Also confirm that View/Configure permissions are limited to trusted users or groups.

Typical attack path

1. Gain authenticated access to Jenkins with permission to configure Build Monitor Views.
2. Create or rename a Build Monitor View using an embedded HTML or JavaScript payload.
3. Wait for a higher-privileged Jenkins user to open the affected view or a page that renders the view name.
4. Payload executes in the victim's browser in the Jenkins web application context.
5. Use the victim's session to read UI-accessible data, retrieve CSRF crumbs, make authenticated Jenkins requests, trigger builds, or alter Jenkins objects within the victim's permissions.
6. Optionally clean up or rename the view to reduce visibility after the payload has executed.

How to detect it

To determine whether exploitation already occurred, review Jenkins application logs, HTTP access logs from Jenkins or its reverse proxy, Jenkins audit trail logs if enabled, and filesystem configuration artifacts under the Jenkins home directory. Look for Build Monitor View creation or rename activity followed by visits from privileged users to the affected view. Search view configuration XML and exported backups for script tags, encoded HTML, JavaScript URLs, and event-handler attributes inside view name fields. Correlate any suspicious view-name change with subsequent authenticated requests made by users who loaded the poisoned page, especially requests that created or modified jobs, credentials, users, views, security settings, build triggers, or plugin configuration. Browser-executed XSS may not produce a distinctive server-side error, so focus on stored payload artifacts and unusual authenticated activity shortly after affected page views.

• build-monitor-plugin
• Build Monitor View Plugin
• 1.14-860.vd06ef2568b_3f
• uk.co.centrica.jenkins.plugins.buildmonitor
• <script
• </script>
• &lt;script
• javascript:
• onerror=
• onload=
• onclick=
• onmouseover=
• <img
• <svg
• <iframe
• document.cookie
• document.domain
• fetch(
• XMLHttpRequest
• /view/
• config.xml

What your security team should do

• Prioritize upgrade or plugin removal because the EPSS score is high even though the issue is not currently listed in CISA KEV.
• Inventory Jenkins controllers and identify installations of Build Monitor View Plugin version 1.14-860.vd06ef2568b_3f or earlier.
• Restrict Jenkins View/Configure and related view-management permissions to trusted administrators.
• Search Jenkins configuration files and audit logs for recently created or renamed Build Monitor Views containing script-like content.
• Review access logs for users visiting suspicious Build Monitor View URLs after a malicious name may have been stored.
• If suspicious payloads are found, investigate actions performed by users who viewed the affected pages, especially administrators.
• Rotate Jenkins API tokens, credentials, and secrets that may have been visible to compromised sessions.
• Monitor for unexpected job configuration changes, new build triggers, new credentials, new users, or plugin changes following suspected exposure.