Description (CNA)
In Jenkins 2.320 through 2.355 (both inclusive) and LTS 2.332.1 through LTS 2.332.3 (both inclusive) the help icon does not escape the feature name that is part of its tooltip, effectively undoing the fix for SECURITY-1955, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Jenkins project / Jenkins | affected 2.320 before unspecified; affected unspecified through 2.355; affected LTS 2.332.1 before unspecified; affected unspecified through LTS 2.332.3 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.