Description
A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jenkins or control the output of the ElectricFlow API to inject arbitrary HTML and JavaScript in the plugin-provided output on build status pages.
Remediation
References
https://jenkins.io/security/advisory/2019-06-11/#SECURITY-1412
http://www.openwall.com/lists/oss-security/2019/06/11/1
http://www.securityfocus.com/bid/108747
Related Vulnerabilities
CVE-2022-23107 Vulnerability in maven package io.jenkins.plugins:warnings-ng
CVE-2022-33891 Vulnerability in maven package org.apache.spark:spark-core_2.13
CVE-2022-34177 Vulnerability in maven package org.jenkins-ci.plugins:pipeline-input-step
CVE-2021-39153 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2022-36157 Vulnerability in maven package com.xuxueli:xxl-job