GHSA-7q9r-vhg2-789w
Stored XSS vulnerability in Jenkins brakeman Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:brakeman | < 0.13 | 0.13 |
Details
As written in the advisory (Markdown source, shown as plain text).
brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored cross-site scripting vulnerability.
This vulnerability can be exploited by users able to control the Brakeman post-build step input data.\n\nbrakeman Plugin 0.13 escape affected values from the parsed file as they are recorded.
This fix is only applied to newly recorded data after a fixed version of the plugin is installed; historical data may still contain unsafe values.
References
External links from the advisory. They lead to third-party sites.