GHSA-QPG9-83FV-X9CH Improper Neutralization of Input During Web Page Generation in Jenkins

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting XSS vulnerability exploitable by users with the ability to control job names...

jenkins: Improper escaping of job URLs in f:validateButton leads to cross-site scripting vulnerability.

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting XSS vulnerability exploitable by users with the ability to control job names...

PT-2019-11340 · Jenkins · Jenkins

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 2.171 Jenkins LTS versions prior to 2.164.1 Description: The issue is related to a cross-site scripting XSS vulnerability. It occurs because the f:validateButton form control in the Jenkins UI does not properly escap...