Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.

• https://nvd.nist.gov/vuln/detail/CVE-2023-27898
• https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3037
• https://github.com/jenkinsci/jenkins/commit/59ac866d9946d7c296023da0ea78baafd4cf71eb
• https://github.com/advisories/GHSA-j664-qhh4-hpf8