Jenkins Customizable Header Plugin
Monthly
Stored cross-site scripting in Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows authenticated attackers with permission to modify plugin appearance settings to inject persistent JavaScript payloads via a crafted SVG icon, executing in the browser context of any Jenkins user who loads the affected header. Because the header renders on every Jenkins page, a single write operation by a low-privileged attacker broadly affects all platform users, including administrators. No public exploit code has been identified at time of analysis, and SSVC categorizes exploitation as none, though technical impact is rated total.
Stored cross-site scripting in Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows authenticated attackers with permission to modify plugin appearance settings to inject persistent JavaScript payloads via a crafted SVG icon, executing in the browser context of any Jenkins user who loads the affected header. Because the header renders on every Jenkins page, a single write operation by a low-privileged attacker broadly affects all platform users, including administrators. No public exploit code has been identified at time of analysis, and SSVC categorizes exploitation as none, though technical impact is rated total.