Server side cross-site scripting In org.jenkins-ci.main:jenkins-core
Description
Jenkins Cross-Site Scripting vulnerability in help icons Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons. Tooltip values can be contributed by plugins, some of which use user-specified values. This results in a stored cross-site scripting (XSS) vulnerability. Jenkins 2.252, LTS 2.235.4 escapes the tooltip content of help icons.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 2.235.4, 2.252 |
Aliases
1. 2. 3. 4.
References
1. 2. 3. 4.