Description
A cross-site scripting vulnerability exists in Jenkins S3 Plugin 0.10.12 and older in src/main/resources/hudson/plugins/s3/S3ArtifactsProjectAction/jobMain.jelly that allows attackers able to control file names of uploaded files to define file names containing JavaScript that would be executed in another user's browser when that user performs some UI actions.
Remediation
References
https://jenkins.io/security/advisory/2018-04-16/
Related Vulnerabilities
CVE-2019-20503 Vulnerability in maven package org.webjars.npm:electron
CVE-2023-4301 Vulnerability in maven package org.jenkins-ci.plugins:fortify
CVE-2015-1810 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2023-27296 Vulnerability in maven package org.apache.inlong:manager-pojo
CVE-2023-31206 Vulnerability in maven package org.apache.inlong:manager-pojo