Description
Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability.
Remediation
References
Related Vulnerabilities
Liferay Portal URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2023-35029)
WordPress 'admin-ajax.php' SQL Injection Vulnerability (2.1.3)
Apache error log escape sequence injection vulnerability
WordPress Plugin Media Library Categories Multiple Cross-Site Scripting Vulnerabilities (1.1.1)
WordPress Plugin Ajax BootModal Login Security Bypass (1.4.3)