Description
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.50, < 2.414.2 | 2.414.2 | GHSA-5j46-5hwq-gwh7 |
| Maven | org.jenkins-ci.main:jenkins-core | >= 2.415, < 2.424 | 2.424 | GHSA-5j46-5hwq-gwh7 |
Advisories 1
- WID-SEC-2023-2411 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 20, 2023