| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.main:jenkins-core | ≥ 2.177, < 2.197< 2.176.4 | 2.1972.176.4 |
| jenkins | ≤ 2.176.3≤ 2.196 |
Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored XSS vulnerability exploitable by users able to control parts of the reason a queue item is blocked, such as label expressions not matching any idle executors.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free