In Jenkins 2.340 through 2.355 (both inclusive) symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting (XSS) vulnerability.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.jenkins-ci.main:jenkins-core(Maven) | 2.340 | 2.356 | N/A |
| org.jenkins-ci.main:jenkins-core(Maven) | 2.332 | 2.332.4 | N/A |
CVSS Metrics
