GHSA-f8h4-46xv-h7jj
Jenkins HTML Publisher Plugin has a XSS vulnerability in the legacy wrapper file
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:htmlpublisher | < 427.1 | 427.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Jenkins HTML Publisher Plugin versoins 427 and earlier do not escape the job name and URL in the legacy wrapper file.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
HTML Publisher Plugin 427.1 escapes job name and URL when generating the legacy wrapper file.
References
External links from the advisory. They lead to third-party sites.