GHSA-mv77-fj63-q5w8HighCVSS 8.0

Stored XSS vulnerability in Jenkins GitHub Plugin

Published
October 25, 2023
Last Modified
November 11, 2023

🔗 CVE IDs covered (1)

CVE-2023-46650 →

📋 Description

Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

GitHub Plugin 1.37.3.1 escapes GitHub project URL on the build page when showing changes.

🎯 Affected products1

  • maven/com.coravy.hudson.plugins.github:github:< 1.37.3.1

🔗 References (5)