high8.0
CVE-2023-40346
Jenkins Shortcut Job Plugin stored cross-site scripting vulnerability
Impact
Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure shortcut jobs. Shortcut Job Plugin 0.5 escapes the shortcut redirection URL.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.jenkins.plugins:shortcut-job | < 0.5 | 0.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Shortcut Job | through 0.4 |