| Package | Affected versions | Patched versions |
|---|---|---|
| de.wellnerbou.jenkins:git-changelog | < 2.7 | 2.7 |
| git changelog | ≤ 2.6 |
A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, GitLogBasicChangelogPostPublisher/config.jelly that allows attackers able to control the Git history parsed by the plugin to have Jenkins render arbitrary HTML on some pages.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free