Description
Jenkins Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes, resulting in a stored cross-site scripting vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins project | Jenkins Matrix Project Plugin | unspecified – ≤ 1.16 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | jenkins-2-plugins | 4.3.1601981312-1.el7 | RHSA-2020:4265, RHSA-2020:3625, RHSA-2020:3453 |
| Red Hat OpenShift 4 | python-rsa +1 | 4.5-1.el7 | RHSA-2020:3453 |
| Red Hat OpenShift 3 | jenkins | 2.235.2.1597220898-1.el7 | RHSA-2020:3541 |
| Red Hat OpenShift 3 | jenkins-2-plugins | 3.11.1597310986-1.el7 | RHSA-2020:3541 |
| Red Hat OpenShift 3 | openshift-ansible +4 | 3.11.272-1.git.0.79ab6e9.el7 | RHSA-2020:3541 |
| Red Hat OpenShift 3 | python-rsa +1 | 4.5-2.el7 | RHSA-2020:3541 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:matrix-project | < 1.17 | 1.17 | GHSA-w43x-5f8f-686p |
Advisories 4
- RHSA-2020:3541 Red Hat Security Advisory: OpenShift Container Platform 3.11 security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2020:3453 Red Hat Security Advisory: OpenShift Container Platform 4.5.6 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2020:4265 Red Hat Security Advisory: OpenShift Container Platform 4.3.40 jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2020:3625 Red Hat Security Advisory: OpenShift Container Platform 4.4.20 jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Jun 27, 2026