CVE-2022-27200

The CVE-2022-27200 entry identifies a stored XSS in Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier, caused by this plugin not escaping role names on the configuration form. Exploitation requires Overall/Administer permission, enabling an attacker to inject script via role name...

CVE-2025-24401

The Jenkins Folder-based Authorization Strategy Plugin (version 217.vd5b_18537403e and earlier) fails to verify whether permissions configured to be granted are actually enabled. This flaw may allow users who were previously granted certain permissions—specifically optional ones like Overall/Mana...