| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:rundeck | < 3.6.11 | 3.6.11 |
| rundeck | ≤ 3.6.10 |
Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads. Rundeck Plugin 3.6.11 sanitizes URLs submitted in Rundeck webhook payloads.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free