Description
Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Script Security Plugin | unspecified – ≤ 1.72 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.4.1598545590-1.el7 | RHSA-2020:3625, RHSA-2020:3207 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:script-security | < 1.73 | 1.73 | GHSA-q87g-7mp5-765q |
Advisories 2
- RHSA-2020:3625 Red Hat Security Advisory: OpenShift Container Platform 4.4.20 jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2020:3207 Red Hat Security Advisory: OpenShift Container Platform 4.5.4 jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Nov 22, 2025