Description
Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to affects view content such as job display name or pipeline stage names.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Pipeline Aggregator View Plugin | unspecified – ≤ 1.8 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.paul8620.jenkins.plugins:pipeline-aggregator-view | < 1.9 | 1.9 | GHSA-jf8x-943c-r4h6 |