Description
The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScript, resulting in a cross-site scripting vulnerability through specially crafted URLs.
Remediation
References
http://www.securityfocus.com/bid/101927
https://jenkins.io/security/advisory/2017-11-16/
Related Vulnerabilities
CVE-2018-6874 Vulnerability in maven package org.webjars.npm:auth0-js
CVE-2021-25329 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2016-4469 Vulnerability in maven package org.apache.archiva:archiva-webapp
CVE-2016-5393 Vulnerability in maven package org.apache.hadoop:hadoop-common
CVE-2019-1003034 Vulnerability in maven package org.jenkins-ci.plugins:job-dsl