~ / search / GHSA-jg35-vf67-gg2j

GHSA-jg35-vf67-gg2j

Jenkins Shortcut Job Plugin stored cross-site scripting vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-40346

Packages

EcosystemPackageAffectedFixed in
Maven io.jenkins.plugins:shortcut-job < 0.5 0.5

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure shortcut jobs. Shortcut Job Plugin 0.5 escapes the shortcut redirection URL.

References

External links from the advisory. They lead to third-party sites.