CVE-2022-27200

The CVE-2022-27200 entry identifies a stored XSS in Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier, caused by this plugin not escaping role names on the configuration form. Exploitation requires Overall/Administer permission, enabling an attacker to inject script via role name...

CVE-2025-24401

CVE-2025-24401 affects the Jenkins Folder-based Authorization Strategy Plugin (versions 217.vd5b_18537403e and earlier). The root cause is that the plugin does not verify that permissions configured to be granted are enabled, potentially letting users who were previously granted optional permissi...