GHSA-62wf-24c4-8r76
Cross-site Scripting vulnerability in Jenkins
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.350, < 2.356 | 2.356 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.320, < 2.332.4 | 2.332.4 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.346, < 2.346.1 | 2.346.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Since Jenkins 2.320 and LTS 2.332.1, help icon tooltips no longer escape the feature name, effectively undoing the fix for [SECURITY-1955](https://www.jenkins.io/security/advisory/2020-08-12/#SECURITY-1955).
This vulnerability is known to be exploitable by attackers with Job/Configure permission.
Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability, the feature name in help icon tooltips is now escaped.
References
External links from the advisory. They lead to third-party sites.