Description
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability.
Remediation
References
https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1889
Related Vulnerabilities
CVE-2021-21277 Vulnerability in npm package angular-expressions
CVE-2022-24948 Vulnerability in maven package org.apache.jspwiki:jspwiki-main
CVE-2023-44483 Vulnerability in maven package org.apache.santuario:xmlsec
CVE-2020-6460 Vulnerability in maven package org.webjars.npm:electron
CVE-2009-2625 Vulnerability in maven package xerces:xercesimpl