GHSA-3892-qqv6-h2qm
Stored XSS vulnerability in Jenkins S3 Publisher Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:s3 | < 0.11.0 | 0.11.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containing JavaScript that would be executed in another user's browser when that user performs some UI actions.
References
External links from the advisory. They lead to third-party sites.