Description
A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Lockable Resources Plugin | 2.4 and earlier | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1553788831-1.el7 | RHSA-2019:1423 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.6wind.jenkins:lockable-resources | < 2.5 | 2.5 | GHSA-wqjj-c9cx-q7cf |
Advisories 1
- RHSA-2019:1423 Red Hat Security Advisory: Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- [oss-security] 20190328 Re: Multiple vulnerabilities in Jenkins plugins mailing-list
- 107628 vdb-entry
- RHSA-2019:1423 vendor-advisory
- https://jenkins.io/security/advisory/2019-03-25/#SECURITY-1361