Note:
This project will be discontinued after December 13, 2021. [more]
2019-01-09
A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins.
| Products | Jenkins |
| Type | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79) |
| First patch | - None (likely due to unavailable code) |
| Links |
• https://jenkins.io/security/advisory/2018-10-10/#SECURITY-1129
• http://www.securityfocus.com/bid/106532 |