Improper Neutralization of Input During Web Page Generation in Jenkins
Moderate severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Dec 22, 2023
Package
Affected versions
<= 2.235.3
>= 2.237, <= 2.251
Patched versions
2.235.4
2.252
Description
Published by the National Vulnerability Database
Aug 12, 2020
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Jun 23, 2022
Last updated
Dec 22, 2023
Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.
References