XSS vulnerability in Jenkins TICS Plugin

2022-05-2417:39:13

Google

osv.dev

0.001 Low

EPSS

Percentile

34.0%

JSON

Jenkins TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses.

This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.

Jenkins TICS Plugin 2020.3.0.7 escapes TICS service responses, or strips HTML out, as appropriate.

CPENameOperatorVersion
io.jenkins.plugins:ticseq2020.3.0.2
io.jenkins.plugins:ticseq1.0
io.jenkins.plugins:ticseq2020.3.0.1
io.jenkins.plugins:ticseq2020.3.0.6
io.jenkins.plugins:ticseq2020.3.0.4
io.jenkins.plugins:ticseq2020.3.0.0

Name	Operator	Version
io.jenkins.plugins:tics	eq	2020.3.0.2
io.jenkins.plugins:tics	eq	1.0
io.jenkins.plugins:tics	eq	2020.3.0.1
io.jenkins.plugins:tics	eq	2020.3.0.6
io.jenkins.plugins:tics	eq	2020.3.0.4
io.jenkins.plugins:tics	eq	2020.3.0.0