| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:config-file-provider | < 3.5 | 3.5 |
| config file provider | ≤ 3.4.1 | |
| openshift container platform | = 3.11 |
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete the shared configuration file.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free