| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:brakeman | < 0.13 | 0.13 |
| brakeman | ≤ 0.12 |
brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored cross-site scripting vulnerability.
This vulnerability can be exploited by users able to control the Brakeman post-build step input data.\n\nbrakeman Plugin 0.13 escape affected values from the parsed file as they are recorded.
This fix is only applied to newly recorded data after a fixed version of the plugin is installed; historical data may still contain unsafe values.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free