Description
Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins instances.
Remediation
References
Related Vulnerabilities
PleskWin Exposure of Resource to Wrong Sphere Vulnerability (CVE-2023-43784)
Liferay Portal Cleartext Storage of Sensitive Information Vulnerability (CVE-2021-33323)
WordPress Plugin Cart66 Lite::WordPress Ecommerce Multiple Vulnerabilities (1.5.3)
phpMyAdmin Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-4729)
Prototype Improper Privilege Management Vulnerability (CVE-2020-7993)