| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:claim | < 2.18.2 | 2.18.2 |
| claim | ≤ 2.18.1 |
Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name shown in claims.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins.
Everyone with a Jenkins account can change their own display name.\n\nClaim Plugin 2.18.2 escapes the user display name shown in claims.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free