GHSA-xj29-gfww-j67g
Jenkins JaCoCo Plugin vulnerable to Stored Cross-site Scripting
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:jacoco | < 3.3.2.1 | 3.3.2.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action. Version 3.3.2.1 escapes class and method names shown on the UI.
References
External links from the advisory. They lead to third-party sites.