Jenkins Update Center2
Monthly
Stored cross-site scripting in Jenkins update-center2 3.18.3 and earlier allows an attacker who can submit a plugin for hosting to inject malicious script into plugin download index pages by embedding payloads in plugin names, descriptions, or version metadata. Any user who browses the affected plugin index page triggers the XSS payload in their browser session. No exploitation has been confirmed (SSVC: none, no KEV), and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Jenkins update-center2 3.18.3 and earlier allows an attacker who can submit a plugin for hosting to inject malicious script into plugin download index pages by embedding payloads in plugin names, descriptions, or version metadata. Any user who browses the affected plugin index page triggers the XSS payload in their browser session. No exploitation has been confirmed (SSVC: none, no KEV), and no public exploit code has been identified at time of analysis.