GHSA-j664-qhh4-hpf8
Cross-site Scripting vulnerability in Jenkins
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.376, < 2.394 | 2.394 |
| Maven | org.jenkins-ci.main:jenkins-core | < 2.375.4 | 2.375.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
References
External links from the advisory. They lead to third-party sites.