| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.main:jenkins-core | ≥ 2.263.2, < 2.275< 2.275 | 2.275 |
| jenkins | ≤ 2.263.1≤ 2.274 |
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents (typically shown after form submissions via Apply button).
This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to influence notification bar contents.
Jenkins 2.275, LTS 2.263.2 escapes the content shown in notification bars.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free