GHSA-x9rq-9h44-f84v
Stored XSS vulnerability in Jenkins ECharts API Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.jenkins.plugins:echarts-api | < 4.7.0-4 | 4.7.0-4 |
Details
As written in the advisory (Markdown source, shown as plain text).
ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts.
This results in a stored cross-site scripting (XSS) vulnerability that can be exploited by users with Job/Configure permission.
ECharts API Plugin 4.7.0-4 escapes the parser identifier.
References
External links from the advisory. They lead to third-party sites.