Description
A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins.
Remediation
References
Related Vulnerabilities
MySQL CVE-2020-2924 Vulnerability (CVE-2020-2924)
Liferay Portal URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2025-62253)
WordPress Plugin Listing, Classified Ads & Business Directory-uListing Arbitrary File Upload (1.2.1)
WordPress Plugin Aspose Importer & Exporter Arbitrary File Download (2.0)
Moodle 7PK - Security Features Vulnerability (CVE-2015-5267)