| Package | Affected versions | Patched versions |
|---|---|---|
| io.jenkins.plugins:warnings-ng | < 2.0.0 | 2.0.0 |
| warnings next generation | ≤ 1.0.1 |
A cross-site scripting vulnerability exists in Jenkins Warnings Next Generation Plugin 1.0.1 and earlier in src/main/java/io/jenkins/plugins/analysis/core/model/DetailsTableModel.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourceDetail.java, src/main/java/io/jenkins/plugins/analysis/core/model/SourcePrinter.java, src/main/java/io/jenkins/plugins/analysis/core/util/Sanitizer.java, src/main/java/io/jenkins/plugins/analysis/warnings/DuplicateCodeScanner.java that allows attackers with the ability to control warnings parser input to have Jenkins render arbitrary HTML.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free