| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:credentials | ≥ 2.3.1, < 2.3.7.1≥ 2.3.14, < 2.3.14.1≥ 2.3.15, < 2.3.15.1≥ 2.3.16, < 2.3.19≥ 2.3.8, < 2.3.13.1< 2.3.0.1 | 2.3.7.12.3.14.12.3.15.12.3.192.3.13.12.3.0.1 |
| credentials | ≤ 2.3.18 |
Jenkins Credentials Plugin prior to 2.3.19, 2.3.15.1, 2.3.14.1, 2.3.13.1, 2.3.7.1, and 2.3.0.1 does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.
Jenkins Credentials Plugin 2.3.19, 2.3.15.1, 2.3.14.1, 2.3.13.1, 2.3.7.1, and 2.3.0.1 restricts the user-controlled information it provides to a safe subset.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free