| Package | Affected versions | Patched versions |
|---|---|---|
| org.jenkins-ci.main:jenkins-core | ≥ 2.320, < 2.332.4≥ 2.346, < 2.346.1≥ 2.350, < 2.356 | 2.332.42.346.12.356 |
| jenkins | ≥ 2.320, ≤ 2.355≥ 2.332.1, ≤ 2.332.3 |
Since Jenkins 2.320 and LTS 2.332.1, help icon tooltips no longer escape the feature name, effectively undoing the fix for SECURITY-1955.
This vulnerability is known to be exploitable by attackers with Job/Configure permission.
Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability, the feature name in help icon tooltips is now escaped.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free