Description
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents, resulting in a cross-site scripting (XSS) vulnerability.
Remediation
References
https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1889
Related Vulnerabilities
CVE-2018-1000608 Vulnerability in maven package org.jenkins-ci.plugins:zos-connector
CVE-2013-0239 Vulnerability in maven package org.apache.cxf:cxf-bundle
CVE-2010-2076 Vulnerability in maven package org.apache.axis2:axis2-kernel
CVE-2019-3894 Vulnerability in maven package org.wildfly:wildfly-ee
CVE-2018-5158 Vulnerability in maven package org.webjars.npm:pdfjs-dist