| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.plugins:promoted-builds | ≥ 3.11, < 876.v99d29788b< 3.10.1 | 876.v99d29788b3.10.1 |
| promoted builds | ≥ 867.v7c3a_b_83a_eb_79, < 876.v99d29788b_36b_< 3.10.1 | 876.v99d29788b_36b_3.10.1 |
Jenkins promoted builds Plugin provides dedicated support for defining promotions using Job DSL Plugin.
promoted builds Plugin 873.v6149db_d64130 and earlier does not validate the names of promotions defined in Job DSL. This allows attackers with Job/Configure permission to create a promotion with an unsafe name. As a result, the promotion name could be used for cross-site scripting (XSS) or to replace other config.xml files.
promoted builds Plugin 876.v99d29788b_36b_ and 3.10.1 validates the name of promotions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free