Description
Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Remediation
References
https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617
Related Vulnerabilities
CVE-2021-33036 Vulnerability in maven package org.apache.hadoop:hadoop-yarn-server-common
CVE-2014-3600 Vulnerability in maven package org.apache.activemq:activemq-broker
CVE-2019-1003066 Vulnerability in maven package org.jvnet.hudson.plugins:bugzilla
CVE-2016-4430 Vulnerability in maven package org.apache.struts:struts2-core
CVE-2017-1000084 Vulnerability in maven package org.jenkins-ci.plugins:parameterized-trigger