Description
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter.
Remediation
References
Related Vulnerabilities
Coppermine Cross-site Scripting (XSS) Vulnerability (CVE-2018-14478)
Drupal Core 7.x Multiple Vulnerabilities (7.0 - 7.15)
WordPress Plugin Car Rental System SQL Injection (3.0)
MySQL CVE-2016-9841 Vulnerability (CVE-2016-9841)
WordPress Plugin WordPress File Upload Cross-Site Request Forgery (2.4.1)