Description
Jenkins Matrix Project Plugin 1.16 and earlier does not escape the node names shown in tooltips on the overview page of builds with a single axis, resulting in a stored cross-site scripting vulnerability.
Remediation
References
https://jenkins.io/security/advisory/2020-07-15/#SECURITY-1924
http://www.openwall.com/lists/oss-security/2020/07/15/5
Related Vulnerabilities
CVE-2022-31127 Vulnerability in npm package next-auth
CVE-2017-4991 Vulnerability in maven package org.cloudfoundry.identity:cloudfoundry-identity-uaa
CVE-2022-25842 Vulnerability in maven package com.alibaba.oneagent:one-java-agent-plugin
CVE-2022-0841 Vulnerability in npm package npm-lockfile
CVE-2021-21179 Vulnerability in maven package org.webjars.npm:electron