GHSA-gfhj-524q-gcrm
Stored XSS vulnerability in Jenkins console links
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | < 2.235.2 | 2.235.2 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.236, < 2.245 | 2.245 |
Details
As written in the advisory (Markdown source, shown as plain text).
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the `href` attribute of links to downstream jobs displayed in the build console page. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission.
Jenkins 2.245, LTS 2.235.2 escapes the `href` attribute of these links.
References
External links from the advisory. They lead to third-party sites.