Jenkins HTML Publisher Plugin 427 and earlier does not escape job name and URL in the legacy wrapper file, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
| Vendor | Product | Versions |
|---|---|---|
| jenkins | html publisher plugin | 0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| jenkins | jenkins | cert_advisory | 90% |
Updated affected versions, marked exploit as available and actively exploited, and added a security advisory tag.
Updated severity to HIGH and corrected exploit availability to false.
Initial creation
