HIGH 8.8
GHSA-j664-qhh4-hpf8
Cross-site Scripting vulnerability in Jenkins
Quick fix
GHSA-j664-qhh4-hpf8 — org.jenkins-ci.main:jenkins-core: upgrade to the fixed version with the command below.
# pom.xml: bump <version>2.394</version> for org.jenkins-ci.main:jenkins-coreDetails
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven / org.jenkins-ci.main:jenkins-core
Introduced in:
2.376 Fixed in: 2.394 Fix
# pom.xml: bump <version>2.394</version> for org.jenkins-ci.main:jenkins-core Maven / org.jenkins-ci.main:jenkins-core
Introduced in:
0 Fixed in: 2.375.4 Fix
# pom.xml: bump <version>2.375.4</version> for org.jenkins-ci.main:jenkins-core