Description
The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScript, resulting in a cross-site scripting vulnerability through specially crafted URLs.
Remediation
References
http://www.securityfocus.com/bid/101927
https://jenkins.io/security/advisory/2017-11-16/
Related Vulnerabilities
CVE-2019-18799 Vulnerability in maven package org.webjars.npm:node-sass
CVE-2020-26256 Vulnerability in npm package fast-csv
CVE-2022-36083 Vulnerability in npm package jose-node-esm-runtime
CVE-2020-2146 Vulnerability in maven package fr.edf.jenkins.plugins:mac
CVE-2023-46234 Vulnerability in maven package org.webjars.npm:browserify-sign