Server side cross-site scripting In org.jenkins-ci.main:jenkins-core
Description
Stored XSS vulnerability in Jenkins console links
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the href attribute of links to downstream jobs displayed in the build console page. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission.
Jenkins 2.245, LTS 2.235.2 escapes the href attribute of these links.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 2.235.2, 2.245 |
Aliases
1. 2. 3. 4.
References
1. 2. 3.