A cross-site scripting vulnerability exists in Jenkins Git Changelog Plugin 2.6 and earlier in GitChangelogSummaryDecorator/summary.jelly, GitChangelogLeftsideBuildDecorator/badge.jelly, GitLogJiraFilterPostPublisher/config.jelly, GitLogBasicChangelogPostPublisher/config.jelly that allows attackers able to control the Git history parsed by the plugin to have Jenkins render arbitrary HTML on some pages.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| de.wellnerbou.jenkins:git-changelog(Maven) | 0 | 2.7 | N/A |
CVSS Metrics
