Description
The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScript, resulting in a cross-site scripting vulnerability through specially crafted URLs.
Remediation
References
http://www.securityfocus.com/bid/101927
https://jenkins.io/security/advisory/2017-11-16/
Related Vulnerabilities
CVE-2021-3918 Vulnerability in npm package json-schema
CVE-2017-2649 Vulnerability in maven package org.jenkins-ci.plugins:active-directory
CVE-2019-11069 Vulnerability in npm package sequelize
CVE-2021-23574 Vulnerability in npm package js-data
CVE-2019-3868 Vulnerability in maven package org.keycloak:keycloak-core