| Package | Affected versions | Patched versions |
|---|---|---|
| se.diabol.jenkins.pipeline:delivery-pipeline-plugin | < 1.0.8 | 1.0.8 |
| delivery pipeline | ≤ 1.0.7 |
The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScript, resulting in a cross-site scripting vulnerability through specially crafted URLs. Version 1.0.8 of the plugin converts the value to a boolean (true/false) and inserts that into the page instead.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free