Description
Jenkins Template Workflows Plugin 41.v32d86a_313b_4a and earlier does not escape names of jobs used as buildings blocks for Template Workflow Job, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create jobs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins Template Workflows Plugin | ≤ 41.v32d86a_313b_4a | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins.plugin.templateWorkflows:template-workflows | <= 41.v32d86a | — | GHSA-62v2-xwh3-5gvx |
Advisories 1
- WID-SEC-2023-1471 Jenkins Core und Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 14, 2023