Описание
XSS vulnerability in Jenkins notification bar
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents (typically shown after form submissions via Apply button).
This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to influence notification bar contents.
Jenkins 2.275, LTS 2.263.2 escapes the content shown in notification bars.
Пакеты
org.jenkins-ci.main:jenkins-core
< 2.263.1
2.275
org.jenkins-ci.main:jenkins-core
>= 2.263.2, <= 2.274
2.275
Связанные уязвимости
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability.
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability.
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape not ...