| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.main:jenkins-core | ≥ 2.165, < 2.172< 2.164.2 | 2.1722.164.2 |
| jenkins | ≤ 2.164.1≤ 2.171 | |
| communications cloud native core automated test suite | = 1.9.0 | |
| openshift container platform | = 3.11 |
The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free