CVE-2023-39151

A flaw was found in Jenkins, where Jenkins weekly and LTS are vulnerable to Cross-site scripting caused by the improper validation of user-supplied input. A remote, authenticated attacker can inject malicious script into a web page, which would be executed in a victim’s Web browser within the security context of the hosting Web site once the page is viewed. This flaw allows an attacker to steal the victim’s cookie-based authentication credentials.