GHSA-48hr-jg4p-w4p4
XSS vulnerability in Jenkins Claim Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:claim | < 2.18.2 | 2.18.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name shown in claims.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins.
Everyone with a Jenkins account can change their own display name.\n\nClaim Plugin 2.18.2 escapes the user display name shown in claims.
References
External links from the advisory. They lead to third-party sites.