GHSA-q397-w28f-jx97
Stored XSS vulnerability in Jenkins ECharts API Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.jenkins.plugins:echarts-api | < 4.7.0-4 | 4.7.0-4 |
Details
As written in the advisory (Markdown source, shown as plain text).
ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart.
This results in a stored cross-site scripting (XSS) vulnerability that can be exploited by users with Run/Update permission.
ECharts API Plugin 4.7.0-4 escapes the display name.
References
External links from the advisory. They lead to third-party sites.