Description
Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Jenkins Health Advisor server responses.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jenkins Project | Jenkins Health Advisor by CloudBees Plugin | ≤ 374.v194b_d4f0c8c8 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.jenkins-ci.plugins:cloudbees-jenkins-advisor | < 374.376.v3a_41a_a_142efe | 374.376.v3a_41a_a_142efe | GHSA-xrpq-4g9w-qrwj |
Advisories 1
- WID-SEC-2025-1052 Jenkins Plugins: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 14, 2025
References
- Jenkins Security Advisory 2025-05-14 vendor-advisory