CVE-2024-28157Disclosure(jenkins / gitbucket)

LOWCVSS 8.0 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for jenkins gitbucket systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.

3.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • gitbucket

Threat summary

  • Active exploitation appears in 1 classified signals
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-02-02); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
Products
gitbucket

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-02-02: 1Mentions · 2026-09-19: 1Active Exploitation · 2026-09-19: 1Technical Details · 2026-02-02: 1Technical Details · 2026-09-19: 102-0209-19
Signal classification2 categories
Disclosure
150.0%
Active Exploitation
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-02-021
Disclosure1
2026-09-191
Active Exploitation1
Full discourse2 posts
  • UNDERCODE TESTING@UndercodeUpdate
    Active Exploitation

    🚨 Active Exploitation Alert: Jenkins GitBucket Plugin Stored XSS (#CVE-2024-28157) Threat Analysis and Hardening Guide + Video -Prediction: 📈 1 Positive | 📉 1 Negative https://undercodetesting.com/active-exploitation-alert-jenkins-gitbucket-plugin-stored-xss-cve-2024-28157-threat-analysis-and-hardening-guide-video/ Educational Purposes!

    Post summary

    The post explicitly alerts that CVE-2024-28157, a stored XSS in the Jenkins GitBucket Plugin, is under active exploitation and links to a threat analysis/hardening resource.

    0000045
    749 followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 Backstage TechDocs, Arbitrary Code Execution, #CVE-2024-28157 (Critical) https://dailycve.com/backstage-techdocs-arbitrary-code-execution-cve-2024-28157-critical/

    Post summary

    A critical arbitrary code execution vulnerability (CVE‑2024‑28157) affecting Backstage TechDocs has been publicly disclosed.

    0000050
    162 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appjenkinsgitbucket-jenkins-

Explore more