Description
Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNote', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control this parameter.
Remediation
References
Related Vulnerabilities
WordPress Plugin WP Migrate DB Security Bypass (0.6)
WordPress Plugin WP Mobile Detector Multiple Vulnerabilities (3.8)
SharePoint CVE-2020-1447 Vulnerability (CVE-2020-1447)
MediaWiki Incorrect Authorization Vulnerability (CVE-2022-29906)
Oracle Database Server CVE-2009-1979 Vulnerability (CVE-2009-1979)