| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:global-build-stats | ≤ 1.5 | |
| global-build-stats | ≤ 1.5 |
Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free