Cross-site Scripting in Jenkins Blue Ocean Plugin
Moderate severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Dec 7, 2023
Description
Published by the National Vulnerability Database
Feb 6, 2019
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Nov 1, 2022
Last updated
Dec 7, 2023
A cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.
This vulnerability is found in:
References