| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:rapiddeploy-jenkins | < 4.2.1 | 4.2.1 |
| rapiddeploy | ≤ 4.2 |
RapidDeploy Plugin 4.2 and earlier does not escape package names in its displayed table of packages obtained from a remote server. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to configure jobs.
RapidDeploy Plugin 4.2.1 escapes package names.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free