Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the ‘caption’ constructor parameter of ‘ExpandableDetailsNote’, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Alpine | 3.18-community | noarch | jenkins | = 2.387.3-r0 | UNKNOWN |
Alpine | 3.19-community | noarch | jenkins | = 2.414.3-r0 | UNKNOWN |