| Package | Affected versions | Patched versions |
|---|---|---|
| com.groupon.jenkins-ci.plugins:DotCi | ≤ 2.40.00 | |
| dotci | ≤ 2.40.00 |
DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause.
This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted commit notifications to the /githook/ endpoint (see also SECURITY-2867).
This vulnerability is only exploitable in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier. See the LTS upgrade guide.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free