PT-2020-15408 · Jenkins · Jenkins Echarts Api Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins ECharts API Plugin versions 4.7.0-3 and earlier Description: The issue results in a stored cross-site scripting vulnerability due to the failure to escape the display name of the builds in the trend chart. This can be exploited by use...

Stored XSS vulnerability in echarts-api

echarts-api 4.7.0-3 and earlier does not escape the parser identifier when rendering charts. This results in a stored cross-site scripting XSS vulnerability that can be exploited by users with Job/Configure permission. echarts-api 4.7.0-4 escapes the parser identifier...

Cross-Site Scripting (XSS)

echarts is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript because the format utility tooltip doesn't sanitize the user input...