| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:matrix-project | ≥ 1.19, < 1.20< 1.18.1 | 1.201.18.1 |
| matrix project | ≤ 1.19 | |
| communications cloud native core automated test suite | = 1.9.0 |
Jenkins Matrix Project Plugin prior to 1.20 and 1.18.1 does not escape HTML metacharacters in node and label names, and label descriptions.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
Matrix Project Plugin 1.20 and 1.18.1 escapes HTML metacharacters in node and label names, and label descriptions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free