Description (CNA)
In Jenkins 2.340 through 2.355 (both inclusive) the tooltip of the build button in list views supports HTML without escaping the job display name, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Jenkins project / Jenkins | affected 2.340 before unspecified; affected unspecified through 2.355 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.