| Package | Affected versions | Patched versions |
|---|---|---|
| io.jenkins.plugins:markdown-formatter | < 0.2.0 | 0.2.0 |
| markdown formatter | ≤ 0.1.0 |
Jenkins Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter.
Jenkins Markdown Formatter Plugin 0.2.0 uses a different Markdown library that is not affected by this problem.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free