Description
The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScript, resulting in a cross-site scripting vulnerability through specially crafted URLs.
Remediation
References
http://www.securityfocus.com/bid/101927
https://jenkins.io/security/advisory/2017-11-16/
Related Vulnerabilities
CVE-2020-7760 Vulnerability in maven package org.webjars:codemirror
CVE-2018-3722 Vulnerability in npm package merge-deep
CVE-2020-15250 Vulnerability in maven package junit:junit
CVE-2019-10782 Vulnerability in maven package com.puppycrawl.tools:checkstyle
CVE-2016-6798 Vulnerability in maven package org.apache.sling:org.apache.sling.xss